AIPAA 2026 Abstracts

Area 1 - AIPAA
Full Papers

Area 1 - AIPAA

Full Papers
Paper Nr: 7
Title:

Measuring Estimation-to-Policy Drift in LLM Agents
Authors:

Florian Maillard, Mickaël Delamare and Benoit Joly
Abstract: Estimators for autonomous LLM agents are chosen for how accurately they recover an unobserved state. What matters is how many wrong actions the estimate causes, a cost no deployed system can observe, lacking a true state to judge against. We make it observable by imposing that state in a simulated loop and applying one deterministic policy twice, to the estimate and to the truth, so that what separates the two action streams is the estimate. Error is counted at the sensor, at the decision, and in the turns the environment spends where an informed policy would not have left it. Only one of the two arms supports a claim about observer quality, the ablation arm, where an exact sensor hands the estimator the imposed state directly. The end-to-end arm is reported as a feasibility check, because the simulated learner compresses the trajectory it renders. Instantiated as a tutoring agent over twelve 60-turn runs and 5 estimators, 3 analytic and 2 LLMs used as recursive observers, the measurement separates them differently at each point: two estimators several times apart at the sensor are indistinguishable at the decision and apart again at the stage, so a panel sized to separate estimators at the sensor can leave undecided the count a designer would act on. The separations are bounded rather than established: one trajectory, which an offline replay finds atypical, and an ordering that survives the promotion threshold but not the demotion one. We report a feasibility result for the measurement, not a ranking of estimators.
Paper Nr: 8
Title:

NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems
Authors:

Oliver Aleksander Larsen and Mahyar Tourchi Moghaddam
Abstract: Autonomous AI agents increasingly act across organizational boundaries on behalf of human operators: they invoke third-party services, delegate subtasks to other agents, and pay for metered resources. Deploying such agents safely requires five capabilities that today live in separate systems: persistent identity, scoped delegation, peer trust, discovery, and payment. Existing approaches root these capabilities in centralized authorities or cover only subsets, so authority, trust, and payment fracture exactly where autonomy needs continuity: when a key rotates or a delegation must be revoked. We present NostrAgent, a decentralized architecture that unifies all five capabilities over Nostr relays using three custom event kinds: Kind 38100 identity declarations authenticated by BIP340 Schnorr signatures with pre-rotation commitments, Kind 38101 scoped delegation chains whose every hop verifiably narrows the granted capabilities, and Kind 38102 peer attestations forming a Sybil-deterrent trust graph, with Lightning HTTP 402 (L402) binding payment to agent identity. Identity remains operator-sovereign: the human operator controls it without any registration authority, relays are substitutable transport rather than a trust root, and every authorization decision is replayable offline from signed events. We evaluate a Python prototype with a mixed-method design: ATAM quality analysis with a two-round mini-Delphi expert panel, STRIDE threat modeling across three trust boundaries, eleven benchmarks with non-parametric statistics, and 19 failure modes. Measured results show sub-millisecond offline verification, linear delegation-chain scaling, and end-to-end Lightning-settled L402 at 157 ms median on regtest. 17 of 19 failure modes pass empirical tests, one is bounded analytically, and one is disclosed as an architectural limitation. NostrAgent demonstrates an auditable prototype substrate for trustworthy agentic systems without centralized trust roots.
Paper Nr: 9
Title:

Evaluating the Division of Labour in Strategic Two-Sided Agentic Marketplaces
Authors:

Jakub MatuĊĦek and Pavel Kordík
Abstract: Language-model agents now act on both sides of online transactions, and the two sides are working against each other. Evaluation built for cooperative multi-agent systems cannot express what matters when interests conflict. It does not measure welfare lost to a decentralised decision, a provider's incentive to misrepresent itself, the communication a given division of labour costs, or position bias as distinct from a correct preference for a well-ranked option. We extend a recent survey's evaluation matrix with four such rows and implement each on the Magentic Marketplace simulator, measuring against a rational rule-based agent that always takes the highest-utility offer it is shown. Varying how many candidates the broker exposes traces a welfare-communication frontier that holds across two domains. Broker capability behaves as welfare per unit of communication. A capable broker reaches near-centralised welfare while the agent inspects two or three proposals, where a weak broker needs about six times the communication for the same welfare. That ordering survives at more than three times the scale, though every broker's welfare level falls there. A language-model customer reaches about half the rational baseline's welfare while using less communication. Its response to manipulation splits by tactic. Fabricated credentials produce no detectable gain, while an indirect prompt injection captures it in all thirty runs, with its own reasoning citing the injected text.