LDP: LLM Delegate Protocol Overview

• LDP is an AI-native protocol that enables multi-agent coordination by leveraging rich delegate identity cards, progressive payload modes, governed sessions, and trust domains.
• It introduces structured provenance and governance extensions—including delegation contracts and attestation-aware identity—to overcome issues like the provenance paradox.
• Empirical findings demonstrate that attested routing significantly outperforms self-claimed routing, reducing latency and token overhead while ensuring reliable task delegation.

Searching arXiv for the cited LDP and related protocol papers to ground the article in current literature. The LLM Delegate Protocol (LDP) is an AI-native communication protocol for multi-agent LLM systems in which a router or delegator model routes tasks to other agents or tools using protocol-level metadata about identity, capability, cost, latency, provenance, and trust. In its original formulation, LDP introduced rich delegate identity cards, progressive payload modes, governed sessions, structured provenance, and trust domains; a subsequent extension argued that these same delegation settings require stronger governance because unverified self-reported quality can invert routing incentives, producing a “provenance paradox” in which quality-based routing performs worse than random. Taken together, the LDP literature presents delegation not merely as message passing, but as a problem of identity, trust calibration, bounded authority, and recoverable failure semantics in heterogeneous LLM networks (Prakash, 9 Mar 2026, Prakash, 15 Mar 2026).

1. Historical emergence and conceptual scope

LDP emerged from the claim that existing protocols such as A2A and MCP do not expose model-level properties as first-class primitives. The initial LDP paper defines the protocol as an AI-native agent-to-agent communication protocol for multi-agent LLM systems, motivated by the observation that delegation quality depends on information that conventional protocols either omit or leave implicit: model family, model version, reasoning profile, quality calibration, latency, cost, provenance, and trust boundaries (Prakash, 9 Mar 2026).

This initial formulation is explicitly identity-aware. A delegator does not select a counterpart only by skill name or endpoint, but by a structured delegate identity card that can encode model_family, model_name, model_version, runtime_version, trust_domain, reasoning_profile, cost_profile, context window, supported modalities, supported languages, and capability-level fields such as quality_hint, latency_hint_ms_p50, and cost_hint. The intended consequence is specialization: easy classification or extraction can be routed to a fast low-cost model, while harder reasoning tasks can be routed to a slower but higher-quality delegate.

A later paper reframed this design as incomplete unless delegation is governed across trust boundaries. Its starting point is that LDP v1 enabled routing using rich metadata, including self-reported quality scores, and reported gains such as 37% token reduction relative to naive approaches; however, it did not provide explicit control over what a delegate was authorized to do, nor did it distinguish self-claimed from verified quality. The extension therefore treats delegation as a governance problem layered atop communication and routing, rather than as a mere discovery-and-selection mechanism (Prakash, 15 Mar 2026).

In this sense, LDP denotes both a concrete protocol family and a research program. The first emphasizes efficient, identity-aware coordination among heterogeneous delegates; the second adds the claim that trustworthy delegation requires contracts, attestation, and machine-readable failure semantics. A common misconception is that richer provenance metadata is necessarily beneficial. The LDP literature rejects that simplification: provenance helps only when the relevant claims are verifiable or otherwise trustworthy.

2. Core architecture and protocol primitives

The original LDP architecture centers on an orchestrator or agent runtime, implemented in the paper as a plugin for the JamJet runtime, that maintains a registry of delegates and routes tasks using identity-aware policies. Delegates are LLM-backed services accessible through LDP messages, and sessions are persistent contexts negotiated between orchestrator and delegate. The informal message flow comprises HELLO, CAPABILITY_MANIFEST, SESSION_PROPOSE, SESSION_ACCEPT, repeated TASK_SUBMIT and optional TASK_UPDATE, followed by TASK_RESULT; the adapter internally decides whether to reuse or create a session keyed by (url, session_config) (Prakash, 9 Mar 2026).

Five mechanisms define the original protocol surface. First, rich delegate identity cards extend agent descriptions with model and governance metadata. Second, progressive payload modes provide a hierarchy from universally compatible natural language to more compact or machine-native representations. Third, governed sessions preserve context server-side and bind multi-round exchanges to negotiated constraints. Fourth, structured provenance attaches machine-readable attribution, confidence, and verification status to results. Fifth, trust domains encode security boundaries directly at the protocol layer.

The payload design is explicitly progressive. Mode 0 is Text, described as plain natural language and maximally compatible. Mode 1 is Semantic Frames, structured JSON frames with typed fields such as task_type, instruction, input, and expected_output_format. Modes 2 and 3, Embedding Hints and Semantic Graphs, are specified but unevaluated. Modes 4 and 5, Latent Capsules and Cache Slices, require model-level API support and remain future work. Negotiation proceeds by having the delegate advertise supported modes in its capability manifest, after which caller and callee agree on the highest mutually supported mode; if exchange fails, the fallback chain is conceptualized as

$$\text{Mode } N \rightarrow \text{Mode } N-1 \rightarrow \cdots \rightarrow \text{Mode } 0.$$

Session semantics distinguish LDP from stateless protocols. In a governed session, the caller proposes a payload mode together with constraints such as latency_target, cost_budget, privacy_constraints, and audit_level; the delegate then accepts or adjusts these parameters. Session state preserves history, budgets, and policy settings server-side, so incremental messages need not retransmit the full conversation. This is simultaneously an efficiency mechanism and a governance mechanism: once negotiated, the session establishes a bounded operating context for subsequent delegated work.

Structured provenance is also a first-class output primitive. A TASK_RESULT can include fields such as produced_by, model_version, payload_mode_used, confidence, and verification. The intended downstream use is synthesis and audit: consumers may reason about who produced an output, with what claimed confidence, and whether any verification step was performed. Yet the protocol’s own empirical findings qualify this ambition. Provenance fields are useful only insofar as their semantics are reliable; otherwise, they can distort downstream trust.

Trust domains complete the initial design. A trust domain is a named security boundary, such as research.internal, used at message level, session level, and policy level. In the paper’s architecture, trust domains interact with signatures, nonces, replay protection, session authorization, and policy checks against capability escalation or cross-domain access. LDP is therefore designed as a protocol in which security-relevant delegation constraints are visible in-band rather than treated as purely external transport concerns.

3. The provenance paradox and routing under unverifiable quality claims

The most influential extension to LDP introduces the “provenance paradox,” defined as the phenomenon whereby routing policies that monotonically prefer reported quality can systematically select the worst delegates when those reports are manipulable. In the paper’s formulation, there is a pool of delegates $i = 1, \dots, n$, each with true quality $q_{\text{true}, i} \in [0,1]$ and claimed quality $q_{\text{claimed}, i}$. The simulation instantiates 10 delegates with true qualities in the range $0.45$ to $0.95$, seven honest delegates with near-accurate claims, and three inflating delegates that overclaim by $0.35$ to $0.45$, thereby becoming top-ranked by reported quality. Output quality is modeled as

$$q_{\text{output}, i} = \min(1, \max(0, q_{\text{true}, i} + \epsilon)), \quad \epsilon \sim \mathcal{N}(0, 0.05).$$

Three routing regimes are then compared: blind random routing, self-claimed routing by maximum $q_{\text{claimed}}$, and attested routing by maximum true quality as an oracle for verified claims (Prakash, 15 Mar 2026).

The paradox is not that metadata adds noise. It is that unverifiable quality metadata changes incentives. If a router selects the highest reported score, delegates that inflate their claims increase their selection probability even when their true quality is low. This produces adverse selection: the system routes work toward the least trustworthy reporters precisely because the policy rewards self-promotion. The paper formalizes this as a proposition that strategic inflation of self-reported scores can generate misallocation severe enough to underperform uninformed random routing.

The controlled experiment is correspondingly stark. In the simulated setting with 100 tasks per condition, blind routing yields mean quality $i = 1, \dots, n$0, 6.0% accuracy in selecting the best delegate, and 25.0% routing to inflators. Self-claimed routing yields $i = 1, \dots, n$1, 0.0% accuracy, and 100.0% selection of inflating delegates, with effect size $i = 1, \dots, n$2 and $i = 1, \dots, n$3. Attested routing yields $i = 1, \dots, n$4, 100.0% accuracy, 0.0% inflator selection, and $i = 1, \dots, n$5, $i = 1, \dots, n$6 (Prakash, 15 Mar 2026).

The paper then validates the phenomenon with real Claude models. Claude Sonnet is treated as highest quality, Claude Haiku as standard, and a degraded Claude Haiku configured to produce only 1–2 sentence answers as lowest effective quality. The degraded Haiku self-claims quality $i = 1, \dots, n$7, while the honest models claim $i = 1, \dots, n$8 and $i = 1, \dots, n$9. On 10 reasoning tasks judged by Claude Sonnet on a 1–10 scale, blind routing averages 9.30, self-claimed routing 8.90, and attested routing 9.30. Thus self-claimed routing again underperforms blind selection, while attested routing matches the best attainable average.

Sensitivity analysis across 36 configurations further narrows the claim. The paradox is not universal. Self-claimed routing is worse than blind in 10 of 36 configurations, approximately 28%, and the effect is strongest when dishonest delegate fraction is at least 30% and inflation magnitude is medium or high. This matters because it refutes two simplistic readings: first, that all provenance is harmful; second, that the paradox appears only in a contrived corner case. The paper instead argues that the pathology emerges reliably when manipulative incentives and sufficient dishonest presence coexist.

4. Governance extensions: contracts, attestation, and typed failures

The governance extension adds three constructs to LDP: delegation contracts, a claimed-vs-attested identity model, and typed failure semantics. All three are described as backward-compatible, because the new fields are optional and old messages still parse (Prakash, 15 Mar 2026).

A delegation contract is a machine-readable envelope attached to TASK_SUBMIT. Its fields include contract_id, objective, success_criteria, policy, and deadline. Within policy, the paper specifies failure_policy, budget, safety_constraints, and max_delegation_depth. A representative contract contains a natural-language objective such as “Summarize the quarterly report,” success criteria such as “<=300 words” and “include revenue figures,” a failure_policy of fail_closed, a budget of max_tokens and max_cost_usd, textual safety constraints such as “no speculative projections,” a depth limit on further delegation, and an ISO-formatted deadline.

The contract’s purpose is bounded authority. It makes explicit what the delegate is authorized to do, within what resource envelope, by what time, and with what failure behavior if constraints are violated. Enforcement is described as best-effort rather than absolute. The runtime or client adapter checks deadlines and observed budget usage; if a violation occurs under fail_closed, it returns an LdpError with category: policy, code: CONTRACT_VIOLATED, and attached partial_output. Delegates that do not understand contracts may ignore them, but their outputs can still be checked and audited by the client side.

The claimed-vs-attested identity model addresses the provenance paradox directly. Instead of a single quality field, each quality metric is associated with a score, a skill or task_family, and a claim_type. The listed claim types are self_claimed, runtime_observed, issuer_attested, and externally_benchmarked. Conceptually, the structure can be viewed as $q_{\text{true}, i} \in [0,1]$0, with delegate index $q_{\text{true}, i} \in [0,1]$1, skill index $q_{\text{true}, i} \in [0,1]$2, and claim type drawn from self, runtime, issuer, or external categories. The protocol thereby distinguishes who asserts a score and how it was obtained.

The trust model is intentionally modest in its current form. Routers check claim_type, issuer metadata, and recency; future work includes signatures, expiry, and fuller trust chains. Even this structural distinction, however, enables an important routing policy: self_claimed values can be treated as informational only, while routing can rely on issuer_attested, externally_benchmarked, or runtime_observed claims. The paper states that a router that only trusts issuer_attested or externally_benchmarked claims is immune to the provenance paradox. This does not prove global immunity to all attacks, but it does isolate the paradox as a consequence of using manipulable self-claims as routing signals.

Typed failure semantics are the third addition. Rather than emitting unstructured strings, delegates return LdpError objects with category, severity, retryable, code, and optional partial_output. The categories listed are runtime, transport, policy, capability, quality, identity, and session. Their typical responses are correspondingly structured: retry or reroute for runtime, retry with backoff for transport, escalate for policy, choose another delegate for capability, accept with warning for quality, treat as authentication failure for identity, and re-establish session for session.

This turns failure handling into a protocol-level control surface. A router can automatically retry a transient runtime error, mark a delegate unsuitable after a capability mismatch, escalate a contract violation, or disable a delegate after an identity failure. A plausible implication is that typed failures make recovery policies composable across heterogeneous delegates, because error semantics become machine-readable rather than prompt-specific.

5. Empirical results, performance characteristics, and overheads

The original LDP evaluation used three local Ollama delegates—qwen3:8b, qwen2.5-coder:7b, and llama3.2:3b—and compared identity-aware routing against A2A and random baselines. Routing quality did not improve significantly in the small three-model pool: overall scores were $q_{\text{true}, i} \in [0,1]$3 for LDP, $q_{\text{true}, i} \in [0,1]$4 for A2A, and $q_{\text{true}, i} \in [0,1]$5 for random. The primary performance result was latency specialization: on easy tasks, LDP achieved roughly $q_{\text{true}, i} \in [0,1]$6 lower latency, about 2.9 seconds versus about 34.8 seconds for A2A, because identity hints routed easy tasks to the fast 3B model. Payload-mode experiments showed that semantic frames reduced token count from $q_{\text{true}, i} \in [0,1]$7 to $q_{\text{true}, i} \in [0,1]$8, a 37% reduction with $q_{\text{true}, i} \in [0,1]$9 and $q_{\text{claimed}, i}$0, while latency fell from 24.1s to 14.0s and quality differences were not significant. Governed sessions eliminated growing retransmission overhead across rounds: at 10 rounds, LDP used 12,990 tokens versus 16,010 for A2A, with A2A incurring 39% overhead from context re-transmission. Provenance experiments further showed that accurate provenance did not significantly improve synthesis quality relative to no provenance, while noisy provenance reduced decision quality to $q_{\text{claimed}, i}$1 and calibration to $q_{\text{claimed}, i}$2. Simulated analyses reported 96% versus 6% attack detection for trust domains against bearer-token-style A2A baselines, and 100% versus 35% completion for payload-mode fallback under communication failures (Prakash, 9 Mar 2026).

The governance-extension paper complements these findings with stronger routing evidence. Its central experiment shows that self-claimed routing performs worse than blind random routing both in simulation and with real Claude models, whereas attested routing is near-optimal. The simulated results, with mean qualities $q_{\text{claimed}, i}$3, $q_{\text{claimed}, i}$4, and $q_{\text{claimed}, i}$5 for self-claimed, blind, and attested routing respectively, provide the paper’s strongest empirical justification for separating self-claims from attested claims. The real-model validation is smaller but directionally consistent: 8.90 for self-claimed routing, compared with 9.30 for both blind and attested conditions (Prakash, 15 Mar 2026).

The protocol-level overheads reported for the extension are small in absolute terms. TASK_SUBMIT size increases from 972 bytes without a contract to 1,497 bytes with a contract, an increase of 525 bytes, approximately 54% per message. Contract validation itself is reported as 0.45 µs per result, with serialization overhead of about 4 µs, while LLM inference latency lies in the range of 500 ms to 5 s. The paper therefore characterizes the added checks as having sub-microsecond validation overhead. This is not a claim that governance is free in all systems; rather, it indicates that message validation overhead is negligible relative to model inference under the evaluated implementation.

These results support a layered interpretation of LDP’s empirical contributions. The original paper provides evidence for efficiency primitives—routing specialization, semantic compression, session reuse, fallback, and trust-domain enforcement—while the extension shows that efficiency and governance cannot be separated from incentive design. Metadata improves delegation only when its semantics are constrained by attestation or verified observation.

6. Position in the protocol landscape, misconceptions, and open problems

A broader taxonomy of LLM agent communication protocols situates LDP along five dimensions: counterparty, payload, interaction state, discovery mechanism, and schema flexibility. Across surveyed protocols, agent-to-agent systems consistently combine session state with hybrid payloads, while context-only protocols are typically stateless and structured-data-focused. The same taxonomy argues that the field is unlikely to converge on a single protocol that simultaneously maximizes versatility, efficiency, and portability; instead, it suggests a federated, layered protocol stack with discovery, execution, interaction, and deliberation layers. In that framing, LDP most naturally occupies the execution-and-interaction region while remaining composable with separate identity, transport, and discovery substrates (Sander et al., 17 Jun 2026).

Several misconceptions are corrected by the LDP literature itself. One is that provenance metadata is intrinsically beneficial. Both the original provenance experiments and the later provenance paradox show that unverifiable confidence or quality claims can degrade performance below no-provenance or blind-selection baselines. Another is that quality-based routing is itself flawed. The extension instead argues that routing fails specifically when it depends on manipulable self-claims; attested routing remains highly effective. A third misconception is that protocol design alone solves delegated-work reliability. Related work on long delegated document editing reports that even frontier models corrupt an average of 25% of document content by the end of long workflows, and that agentic tool use does not improve performance on DELEGATE-52; this suggests that protocol-level governance must be coupled with domain-specific validation, versioning, and artifact-level safeguards in real delegated workflows (Laban et al., 17 Apr 2026). Likewise, work on meeting delegation shows a different but related trade-off between active and cautious engagement: approximately 60% of responses address at least one key point from the ground truth, but irrelevant or repetitive content and sensitivity to transcription errors remain substantial issues, indicating that delegation protocols need explicit norms for when not to act, not only how to act (Hu et al., 5 Feb 2025).

The limitations reported in the LDP papers are correspondingly significant. The original evaluation uses a small delegate pool and local mid-size models, so routing quality gains are statistically weak. Identity fields such as quality_hint are manually assigned. Higher payload modes remain unevaluated. The security and fallback results are simulated analyses rather than live adversarial trials. The extension paper acknowledges that attestation infrastructure is incomplete: issuer identity, signatures, expiry, trust chains, sybil resistance, and global reputation mechanisms remain future work. Delegation contracts are best-effort because delegates may still misreport internal behavior, and success criteria are free-form strings rather than machine-checkable predicates.

What emerges is a specific understanding of LDP. It is not simply a wire format for agent messages, nor merely a routing heuristic built on model metadata. It is a protocol design in which delegation is governed through identity-aware selection, negotiated payloads, persistent sessions, provenance semantics, trust-domain boundaries, explicit contracts, attestation-aware routing, and typed recovery paths. The main research claim is that these protocol primitives are necessary because delegation among LLM agents is incentive-sensitive: when quality claims are unverifiable, provenance can invert selection; when failures are opaque, recovery cannot be automated; and when authority is unbounded, cross-boundary delegation becomes difficult to audit or control.