Attacks and mitigations for distributed governance of AI agents under Byzantine adversaries

Researchers, addressing the flaw that the agentic AI governance scheme SAGA relies on a centralized trust point, the Provider, and is vulnerable to disruption by a malicious Provider, analyzed and executed multiple concrete attacks after Provider compromise, which can break agent attributability, steal private data, and bypass access control; both private cloud and public cloud deployments face insider threats, further increasing the risk of Provider compromise. The paper then proposes four defense architectures: SAGA-BFT provides full Byzantine fault tolerance and the strongest protection, but the high cost of Byzantine fault-tolerant protocols causes a significant performance drop; SAGA-MON and SAGA-AUD use lightweight server-side monitoring and client-side auditing, respectively, to resist most attack categories with minimal overhead; SAGA-HYB combines Byzantine fault tolerance with monitoring and auditing, trading off between security and performance. The authors evaluated all architectures and compared them with SAGA, and discussed under what conditions each scheme is best.