A protocol lets agents check evidence behind claims
PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication · arXiv:2610.39109
In plain words
When one AI agent tells another that tests passed or a person approved an action, the receiver may be able to verify who sent the message but not whether those events happened.
Proof-Carrying Messages (PCM) is a protocol that attaches signed records from a log the agent cannot change, so the receiver can check evidence for each claim.
In a test set of 712 false claims from real signer runs, PCM accepted 10; plain A2A accepted all 712. All 10 accepted claims had evidence of an event that was later undone.
The research
When one AI agent tells another that a test passed or a person approved an action, how can the receiving agent check the claim if the sender is the only source for it? A message signature confirms who sent the message, but leaves that question open.
PCM attaches signed records from an agent-independent log to its claims, letting receivers check evidence and authority grants offline.
PCM-Lies tests a concrete question: when agents pass claims such as “the tests passed,” how often does a receiver accept a false claim? A signature identifies the sender, but does not verify what the sender says happened.
In this test of false claims, PCM receivers accepted 10 of the same 712 lies that plain A2A accepted in full. All 10 had evidence of events later undone, supporting the conclusion that the protocol checks recorded events but not whether their results remain current.
PCM 0.1 can establish that a recorded event happened, but not that its result is still current or that nothing happened afterward. Its guarantees also depend on trusting the signer and other parties that attest to events.
What the evidence shows
- A message needs evidence
Proof-Carrying Messages (PCM) is a protocol that lets one AI agent check evidence for another agent's claims. The problem is that a signed message can show who sent it without proving that the sender's claims are true.
PCM addresses this by attaching signed records from a log the agent cannot change, which the receiver checks independently.
- Testing false claims
PCM-Lies tests whether receivers accept false claims passed between agents; its main score counts accepted lies out of 712. The messages came from real signer runs, and labels were based on what happened, not on verifier outputs.
On those same 712 lies, PCM accepted 10, while plain A2A, which checks nothing about the message, accepted all 712.
- Evidence can become stale
The remaining PCM false accepts were not fabricated events. All 10 had evidence that the event really happened, but was later undone. That result fits PCM's claim semantics: its evidence can show that a call happened, but does not establish that the result stayed current afterward.
- Self-reports stay unproven
A separate check asked whether an agent's own report could count as proof. PCM marked all 72 claims backed only by the agent's report as unproven.
Together, the results show what PCM checks in this test set and where its event-based evidence stops: it rejects unsupported self-reports, but does not by itself rule out later changes.
Deep
- Original paper authors
- Bravish Ghosh
- Submitted to arXiv
- License
- CC BY 4.0