BFT for LLM agents — three attacks, three aggregators
the three LLM-agent-specific attacks
byzantine lie
one agent outputs wrong
with high confidence
classical BFT handles if f < n/3
mitigation: any majority-based vote
sycophantic conformity
an agent copies whoever
spoke first, low confidence
classical BFT does not detect
mitigation: confidence-weighted (CP-WBFT)
monoculture (correlated errors)
three agents share a base
model; same hallucination
classical BFT fails: all look honest
mitigation: model diversity + verifier
2025-2026 aggregator variants
CP-WBFT
confidence-probe weighted
w(cluster) = sum(c_i)
winner if w/total > threshold
arXiv:2511.10400
+85.71% BFT on complete graphs
DecentLLMs
leaderless, geometric median
workers propose in parallel
evaluator agents score
arXiv:2507.14928
robust when f < n/2
WBFT + Hierarchical Clustering
Core + Edge split
weight = quality * trust(history)
Core consensus first, Edge follows
arXiv:2505.05103
bounds consensus latency