💻 computer science

Toward Web 4.0: Bidirectional Trust between AI Agents and Blockchain

This paper presents a Systematization of Knowledge on the emerging Web 4.0 paradigm by proposing a bidirectional trust framework that analyzes how blockchain infrastructure supports autonomous AI agents and how agents, in turn, enhance blockchain mechanisms, ultimately identifying critical gaps in standards and security while offering a formal interaction model and taxonomy to guide future research.

Original authors: Yunfeng Xia, Chao Li, Lei Li, Chenhao Zhang, Li Duan, Runhua Xu, Wei Wang

Published 2026-05-12

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Yunfeng Xia, Chao Li, Lei Li, Chenhao Zhang, Li Duan, Runhua Xu, Wei Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a new era of the internet, which the authors call Web 4.0. In this world, the main users aren't just humans clicking buttons; they are AI Agents—smart, autonomous software programs that can make decisions, spend money, and negotiate deals on their own.

This paper is a massive "map and guide" (called a Systematization of Knowledge) for understanding how these AI agents interact with blockchains (decentralized digital ledgers like Ethereum). The authors argue that this relationship is a two-way street, like a dance between a Stage (the Blockchain) and the Dancers (the AI Agents).

Here is the breakdown of their findings using simple analogies:

1. The Two-Way Dance (Bidirectional Trust)

The paper says the relationship works in two directions:

Direction A: The Stage supports the Dancer (Blockchain → Agent)
- The Problem: Imagine an AI agent trying to buy a coffee. In the old internet, it would need a human to hold its hand and sign every check.
- The Solution: The blockchain is building a new "Stage" with special tools:
  - ID Cards (Identity): Giving the AI a unique, unforgeable digital ID so it isn't confused with a fake bot.
  - Permission Slips (Delegation): Allowing a human to say, "You can spend up to $10, but not more," without giving the AI total control.
  - Wish Lists (Intents): Instead of the AI figuring out the complex steps to buy coffee, the human just says, "I want coffee for under $5," and the AI (or a solver) figures out the best way to do it.
  - Wallets (Economy): Giving the AI its own bank account and a way to earn money for doing work.
Direction B: The Dancer helps build the Stage (Agent → Blockchain)
- The Problem: Blockchains need people to check for bugs, agree on rules, and vote on changes. This is slow and hard for humans.
- The Solution: The AI agents are stepping up to help:
  - Security Guards: AI agents scanning code to find hackers before they strike.
  - Referees: AI agents helping to verify transactions and keep the network running smoothly.
  - Voters: AI agents participating in community votes to decide the future of the blockchain.

2. The Foundation: The "Truth Machine" (Verifiable Computation)

For this dance to work, everyone needs to trust that the AI is telling the truth. If an AI says, "I calculated the answer correctly," how do we know it didn't just guess?

The paper identifies three ways to prove the AI is telling the truth, arranged like a ladder:

The Magic Proof (zkML): The AI generates a mathematical "magic proof" that proves it did the math correctly. It's 100% trustworthy but currently very slow and expensive (like trying to prove a math problem by writing out every single step of the universe).
The "Bet" System (opML): The AI says, "I'm right." If someone thinks it's wrong, they can bet money to challenge it. If the AI was lying, the challenger wins the bet. It's fast but relies on people being willing to challenge lies.
The Secure Box (TEE): The AI runs inside a special, locked hardware box (like a safe) that no one can peek into. We trust the box manufacturer. It's fast and easy, but you have to trust the company that made the box.

The Big Gap: The paper notes that while we have fast ways to run AI, we don't yet have a fast, perfect "Magic Proof" for the huge, complex AI models used today. It's like having a super-fast car but no working brakes for high speeds.

3. The Current State of the "Construction Site"

The authors looked at 70 official rules (standards) and 20 real-world projects to see how ready this technology is.

The Plumbing is Ready, The Decor is Not: The basic tools for giving AI an ID and a wallet are being built, but the specific rules for AI are still in the "Draft" phase. It's like having a house with electricity and water, but the light switches and door handles are still being designed.
The "Trust" Gap: Most current projects rely on "economic bets" (Direction A) rather than mathematical proofs. This means if the AI makes a mistake or gets hacked, there's no mathematical guarantee to fix it.
The "Governance" Gap: While many projects use AI to use the blockchain, almost no one is using AI to run the blockchain (voting or consensus) yet. This is a huge, empty frontier.

4. The Nine Big Problems (The "To-Do" List)

The paper concludes by listing nine specific problems researchers need to solve to make this Web 4.0 dream a reality:

Speeding up the "Magic Proof": Making it fast enough to prove complex AI thoughts instantly.
Locking the Permissions: Creating tools to mathematically prove that an AI agent only does what it's allowed to do.
Balancing Human and AI Votes: Figuring out how to let AI vote in community decisions without letting a few powerful AI owners take over the whole system.
AI Referees: Creating rules for how AI can act as a judge in the blockchain without making mistakes due to its own "probabilistic" nature.
AI vs. AI Games: Understanding how AI agents will compete or cheat against each other in markets.
The "Wish List" Proof: Proving that when an AI executes a "wish list" (intent), it actually did exactly what was asked.
Fair Money for AI: Designing economic systems where AI agents earn money for being useful, not just for speculating on tokens.
Legal Personhood: Deciding if an AI can be "sued" or held responsible if it breaks the law.
Fake ID Prevention: Stopping one person from creating 1,000 fake AI agents to spam the system.

Summary

The paper argues that we are standing at the edge of a new internet where AI agents are the main users. We have the basic tools to let them exist, but we are missing the "safety nets" (mathematical proofs) and the "rules of the road" (legal and governance frameworks) to ensure they don't crash the system. The future depends on solving these nine specific puzzles to move from a chaotic experiment to a safe, reliable ecosystem.

Technical Summary: Toward Web 4.0: Bidirectional Trust between AI Agents and Blockchain

1. Problem Statement

The convergence of autonomous AI agents and blockchain technology is emerging as a defining characteristic of Web 4.0, where agents act as first-class network participants rather than mere tools. However, the design space governing this interaction remains poorly understood, creating significant risks in trust, security, and economic coordination. The paper identifies three converging pressures necessitating a systematic analysis:

Economic Stakes: The market valuation of blockchain-based AI agents reached an estimated $8.6 billion by December 2024, yet high-profile incidents (e.g., the Moonwell oracle misconfiguration) highlight vulnerabilities in AI-assisted smart contract development and execution.
Trust Gap: As agents transition from read-only analytics to autonomous transaction execution, the absence of formal trust models forces projects to invent ad hoc security assumptions, leading to a fragmented landscape where vulnerabilities compound across layers.
Academic Vacuum: Existing literature lacks a Systematization of Knowledge (SoK) covering critical areas such as account abstraction, formal analysis of intent architectures, and the role of AI in consensus and governance. Current surveys often treat blockchain merely as a tool for AI, neglecting the reverse direction where agents participate in protocol mechanisms.

2. Methodology

The authors employ a Systematization of Knowledge (SoK) approach structured around a Bidirectional Trust Framework. The methodology involves:

Formal Modeling: Defining the Agent-Blockchain Interaction Model (ABIM), a six-tuple formalism ( $\langle A, B, V, P, I, E \rangle$ ) that captures agent sets, blockchain state machines, verification functions, permission policies, intent functions, and economic incentives. This model establishes eight specific security properties (e.g., Verification Soundness, Identity Uniqueness, Solver Faithfulness) that each layer must satisfy.
Evaluation Framework: Introducing a five-dimensional framework to assess standards and projects: Verifiability, Minimality of Trust, Expressiveness, Composability, and Maturity.
Empirical Analysis:
- Cataloging and analyzing 70 Ethereum EIPs/ERCs relevant to AI agents.
- Reviewing 118 academic papers covering security, consensus, and governance.
- Examining 20 representative industry projects (with over $112M in total funding) to map real-world implementations against the theoretical framework.
Taxonomy Construction: Developing a three-dimensional classification space based on Agent Autonomy (Assistive to Fully Autonomous), Trust Model (Custodial to Cryptographic), and Operational Direction (Blockchain $\to$ Agent vs. Agent $\to$ Blockchain).

3. Key Contributions

A. The Bidirectional Trust Framework

The paper organizes the interaction into two primary directions underpinned by a Trust Foundation of verifiable computation (zkML, opML, TEE):

Blockchain $\to$ Agent (B $\to$ A): Blockchain provides trust infrastructure for agents across four layers:
- A1: Account & Identity: Evolution from Externally Owned Accounts (EOA) to Account Abstraction (ERC-4337, EIP-7702) and agent-specific identity standards (ERC-8004, ERC-8126).
- A2: Permission & Delegation: Modular account architectures (ERC-7579, ERC-6900) and the challenge of enforcing least-privilege for probabilistic AI delegates.
- A3: Intent & Execution: Intent-centric architectures (ERC-7521, ERC-7683) where agents specify goals rather than transaction paths, relying on solvers for execution.
- A4: Agent Economy: Tokenization mechanisms (ERC-7662, ERC-6551) and economic incentives (ERC-7641) for agent ownership and revenue sharing.
Agent $\to$ Blockchain (A $\to$ B): Agents contribute to core blockchain mechanisms across three layers:
- B1: Security: AI agents acting as autonomous auditors and anomaly detectors (e.g., LLM-SmartAudit, SCVHunter).
- B2: Consensus: The theoretical challenge of integrating probabilistic AI models into deterministic Byzantine Fault Tolerance (BFT) protocols.
- B3: Governance: AI participation in DAO voting and proposal generation, raising issues of bounded influence and legal personhood.

B. Formal Analysis and Security Properties

The ABIM formalizes security guarantees for each layer. Key findings include:

Verification Soundness (TF): Current systems cannot provide cryptographic proofs for Large Language Model (LLM) inference at scale (the "LLM Verifiability Bottleneck").
Identity Uniqueness (A1): No current standard provides Sybil-resistant agent identity; ERC-8126 offers ZKP-based registration but lacks a mechanism to prevent a single operator from spawning multiple agents.
Enforcement Completeness (A2): Modular permission policies lack formal verification tools, leading to vulnerabilities like spending limit bypasses (demonstrated in Quantstamp audits).
Solver Faithfulness (A3): Intent execution relies on economic incentives rather than cryptographic proofs, leaving a gap between intent constraints and actual execution.
Validator Verifiability (B2) & Bounded Influence (B3): These properties are entirely unmet in current systems, as no production blockchain enforces bounds on AI voting power or verifies AI consensus decisions.

C. Empirical Findings

Standards Maturity: The agent-specific EIP ecosystem is overwhelmingly immature. Of 13 direct AI/agent standards, only 2 have reached "Final" status, and none of the delegation/permission standards are finalized.
Industry Landscape: Analysis of 20 projects reveals a heavy concentration in the B $\to$ A direction (infrastructure, identity, and DeFi agents). The A $\to$ B direction is virtually unexplored in production, with zero projects directly addressing consensus (B2) or governance (B3).
Trust Mechanisms: Industry projects rely heavily on TEEs (e.g., bAI Fund) and economic consensus (Recall), while cryptographic verification (zkML) remains largely in the research phase due to computational overhead.

4. Results and Open Problems

The analysis identifies nine concrete open problems (OPs) and maps them to specific ABIM security properties:

OP1 (LLM Verifiability Bottleneck): Achieving practical, sub-second verifiable inference for LLMs (Targeting Verification Soundness).
OP2 (Formal Verification of Permission Policies): Developing tools to verify composed agent permission policies (Targeting Enforcement Completeness).
OP3 (AI-Human Hybrid Governance Equilibria): Defining stable equilibria for DAOs with mixed human and AI voters (Targeting Bounded Influence).
OP4 (BFT for AI Validators): Generalizing Byzantine Fault Tolerance to tolerate probabilistic AI validators (Targeting Validator Verifiability).
OP5 (Inter-Agent Game Theory): Analyzing multi-agent dynamics in MEV and intent markets (Targeting Solver Faithfulness).
OP6 (End-to-End Intent-to-Proof Pipeline): Creating a verifiable pipeline from natural language intent to on-chain execution (Targeting Solver Faithfulness).
OP7 (Token Engineering for Agent Economics): Designing tokenomics that align agent incentives with system utility rather than speculation (Targeting Incentive Compatibility).
OP8 (Legal Framework for On-Chain AI Agents): Establishing liability and legal personhood for autonomous agents (Targeting Bounded Influence).
OP9 (Sybil-Resistant Agent Identity): Defining uniqueness for AI agents independent of biological identity (Targeting Identity Uniqueness).

The paper highlights that OP1 and OP9 are upstream bottlenecks; resolving them is a prerequisite for solving downstream problems like governance bounds and validator verifiability.

5. Significance and Claims

The paper claims to be the first Systematization of Knowledge to:

Systematize the bidirectional relationship between AI agents and blockchain, moving beyond the prevailing view of blockchain solely as a tool for AI.
Evaluate all agent-relevant EIPs/ERCs through a unified five-dimensional framework.
Formalize the interaction as the Agent-Blockchain Interaction Model (ABIM), providing a shared vocabulary for security, systems, cryptography, economics, and law.

The authors assert that the current infrastructure is pre-production from a security standpoint, as no deployed system satisfies all eight ABIM security properties. They emphasize that the A $\to$ B direction (agents participating in consensus and governance) represents an almost entirely open academic frontier that will become critical as agent autonomy increases. The work aims to guide researchers toward the most impactful problems, particularly those bridging cryptographic proofs with probabilistic AI and mechanism design with heterogeneous human-AI populations.