KDD 2026 · Blue Sky Ideas Track

Trustworthy Agent Network:
Trust in Agent Networks Must Be Baked In, Not Bolted On

Yixiang Yao1, Yuhang Yao2, Xinyi Fan3, Jiechao Gao4, Jie Wang4, Minjia Zhang3, Srivatsan Ravi1, Carlee Joe-Wong2

1University of Southern California · 2Carnegie Mellon University · 3University of Illinois Urbana-Champaign · 4Stanford University

KDD short version arXiv full version GitHub

Abstract

Trust does not compose automatically.

Large Language Models have enabled autonomous agents that plan, call tools, and execute multi-step workflows. As these agents move from isolated tools to collaborative Agent-to-Agent (A2A) networks, specialization and parallelism improve performance—but trust does not compose automatically.

Systemic failures such as adversarial composition, semantic misalignment, data re-identification, and cascading operational failures emerge from interaction dynamics. Bolted-on monitors and filters can detect some unsafe outcomes after the fact, yet leave unsafe trajectories reachable in the underlying transition dynamics.

This vision paper argues that trust must be baked into the coordination fabric: unsafe states should be unreachable by construction. We introduce the Trustworthy Agent Network (TAN) framework and organize it around four design pillars.

Conceptual overview of trust issues and solutions in agent-to-agent networks
Figure 1. Trust in A2A systems must be designed into coordination, not attached after deployment.

Interactive demo

Bolted-on guardrail case study

All four failure modes, shown at once across gpt-5.6-sol, claude-opus-5, and the model-independent TAN defense. Open fullscreen →

Highlights

Bolted-on versus baked-in

External monitors leave unsafe states reachable if detection fails. Baked-in designs remove those transitions from the system topology.

Comparison of bolted-on monitoring versus baked-in constrained safe state space
Figure 2. Bolted-On vs. Baked-In (from the paper).

From vulnerabilities to trust requirements

The paper maps multi-agent failure modes onto four constitutive pillars of a Trustworthy Agent Network.

Mapping from multi-agent vulnerabilities to trust requirements
Figure 3. Left: multi-agent risks. Right: properties required for trustworthy operation.
I

Compositional robustness

Safety must hold under agent composition when messages and tool calls chain.

II

Semantic containment

Shared instructions must stay consistent; protocol-correct messages can still be unsafe.

III

Accountability

Reachable states should encode provenance so actions remain attributable across handoffs.

IV

Cross-boundary reliability

Execution must remain live and bounded—no unbounded loops or resource blow-ups.

Blueprint for trustworthy agent networks

A constrained transition function over typed intents, with the four pillars jointly enforcing a safe state space.

Blueprint for trustworthy agent networks with constrained transitions and four pillars
Figure 4. Blueprint for trustworthy agent networks (from the paper).

References

Cite this work

@article{yao2026trustworthy,
  title={Trustworthy Agent Network: Trust in Agent Networks Must Be Baked In, Not Bolted On},
  author={Yao, Yixiang and Yao, Yuhang and Fan, Xinyi and Gao, Jiechao and Wang, Jie and Zhang, Minjia and Ravi, Srivatsan and Joe-Wong, Carlee},
  journal={KDD 2026 Blue Sky Ideas Track},
  year={2026},
  note={arXiv:2605.19035}
}