Zero-Knowledge Predicate Proof Gateway for Inter-Agent Trust (Defensive Research, Source-Integrity Gap Noted)

Technical Analysis

The work targets a real structural weakness in current multi-agent trust models: agents either over-share raw private data or rely on self-reported natural-language compliance claims, the latter being directly exploitable via prompt injection since a compromised or manipulated agent can simply assert compliance falsely. The proposed Zero-Knowledge Proof Gateway has agents prove governance-defined predicates (e.g., 'value is below threshold') over private data using Bulletproofs, transmitted via a new slot implemented on top of both MCP and A2A protocols, so peers verify compliance without receiving the underlying sensitive value. The authors' own disclosed limitation is that a predicate proof cryptographically binds to a committed value but not necessarily to the authoritative system of record, meaning a malicious or compromised source could still generate a valid proof over a fabricated committed value; their proposed fix couples enclave attestation with the proof to certify the value was read from a specific measured binary. No exploit, malicious payload, or vulnerable deployment is described; this is a hardening proposal for inter-agent trust establishment.

Affected Systems

protocols: MCP, A2A

Detection Signatures

• N/A - defensive research, no attack indicators to signature; if implementing this pattern, monitor for: proofs verified without corresponding enclave/attestation binding, mismatched commitment values between claimed source and system of record, unusually high proof-verification failure rates suggesting spoofed predicate submissions

Remediation Steps

1. 1

   Track source-integrity gap

   If adopting predicate-proof schemes for agent trust, ensure proofs are bound to attested reads from the authoritative system of record, not just to an arbitrary committed value, to prevent a compromised agent from proving false predicates over fabricated data.

2. 2

   Pair with attestation

   Combine zero-knowledge predicate proofs with enclave/TEE attestation (as proposed) so verification certifies both the predicate and the provenance of the measured value.

3. 3

   Independent protocol conformance testing

   Before production use, independently validate the MCP/A2A proof-carrying slot extension against both protocol specs to avoid introducing parsing or downgrade issues at the new interoperability boundary.

4. 4

   Do not treat as identity or authorization mechanism

   Predicate proofs address data minimisation, not agent identity/authentication; continue enforcing separate strong identity and authorization controls for inter-agent calls.