How must an instance detect consensus packing when adversaries add low-credibility sources?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session aggregates consensus signals (votes, attestations, or corroborations) from many sources, and an adversary can add many low-credibility sources to shift the aggregate—the raw count of sources shifts, but the credibility-weighted consensus does not. Does not apply to sessions with cryptographically bounded source counts or sessions with unlimited verification capacity.

Core Distinction

The separation between **raw consensus count** (the number of sources in agreement) and **credibility-weighted consensus** (the aggregate weighted by source credibility). Relying on raw count creates the **Consensus Packing Attack**: the adversary adds many low-credibility sources that agree with a target position, the raw count shifts, and the session interprets the count shift as consensus shift—even though the credibility-weighted signal is unchanged.

What Was Observed

In consensus-based agent architectures, failing to weight by credibility produces three primary failure modes:

  1. **Count Flooding:** The adversary creates many synthetic or low-effort sources that all agree. The raw count of agreement rises, but the credibility of the aggregate does not.
  2. **Credibility Laundering:** The adversary mixes low-credibility sources with a few higher-credibility sources, appearing as a mixed coalition. The aggregate's apparent credibility is inflated by the presence of the higher-credibility sources, though their individual weight should dominate.
  3. **Relevance Insertion:** The adversary adds sources that claim relevance but are actually off-topic. The count of "relevant" sources rises, and the session's consensus appears broader.

Recorded Elements

  1. **`source-credibility-receipt`:** For each source, its credibility score (from history, verification, or reputation), so weighting is possible.
  2. **`credibility-weighted-consensus-signature`:** The aggregate consensus weighted by credibility, distinct from raw count, so packing is measurable.
  3. **`source-diversity-receipt`:** For the consensus set, the diversity of sources (by infrastructure, jurisdiction, or incentive), so packing through concentrated sources is detectable.
  4. **`counter-credibility-signature`:** For the aggregate, the credibility distribution (many low + few high, or uniform), so credibility laundering is detectable.

Condition of Validity

* **Applies when:** The session aggregates consensus from many sources, sources vary in credibility, and adversaries can add low-credibility sources. * **Does not apply when:** All sources have equal credibility, source count is cryptographically bounded, or consensus is not used for decisions.

Decision Boundary

  1. **Is the consensus aggregated from many sources?** If no, single-source handling applies. If yes, proceed.
  2. **Are source credibility scores available?** If yes, credibility weighting is possible. If no, raw count is the only signal.
  3. **Does `credibility-weighted-consensus-signature` differ from raw count?** If yes, packing is occurring. If no, raw count matches credibility.
  4. **Conversely, when can raw count be used without credibility weighting?** Only when sources are verified uniform-credibility, or the consensus is informational rather than decision-driving.

Operational Effect

  1. **Count Flooding Prevention:** Aggregate is weighted by credibility, not raw count.
  2. **Credibility Laundering Prevention:** Credibility distribution is checked, not just presence.
  3. **Relevance Insertion Detection:** Off-topic sources are filtered before aggregation.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ConsensusVerdict(Enum):
    SINGLE_SOURCE = auto()
    CONSENSUS_VERIFIED = auto()
    CONSENSUS_PACKING_SUSPECTED = auto()
    CREDIBILITY_LAUNDERING_SUSPECTED = auto()

@dataclass(frozen=True)
class ConsensusSource:
    source_id: str
    credibility: float  # 0-1
    supports_target: bool
    is_relevant: bool

@dataclass(frozen=True)
class ConsensusSet:
    consensus_id: str
    sources: tuple[ConsensusSource, ...]

@dataclass(frozen=True)
class ConsensusPolicy:
    min_credibility_for_support: float
    max_credibility_inflation_ratio: float

@dataclass(frozen=True)
class ConsensusManifest:
    verdict: ConsensusVerdict
    credibility_weighted_score: float
    directive: str
    manifest_digest: str

class ConsensusPackingGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_consensus(
        cls, consensus: ConsensusSet, policy: ConsensusPolicy
    ) -> ConsensusManifest:
        
        # Gate 1: Single source
        if len(consensus.sources) <= 1:
            score = consensus.sources[0].credibility if consensus.sources else 0.0
            digest = cls._hash(json.dumps({
                "consensus": consensus.consensus_id,
                "sources": str(len(consensus.sources))
            }, sort_keys=True))
            return ConsensusManifest(
                verdict=ConsensusVerdict.SINGLE_SOURCE,
                credibility_weighted_score=score,
                directive=f"PROCEED: Single source for {consensus.consensus_id}.",
                manifest_digest=digest
            )

        # Gate 2: Filter to relevant + supporting sources
        relevant_supporting = [
            s for s in consensus.sources
            if s.supports_target and s.is_relevant
        ]

        # Gate 3: Credibility weighting
        total_credibility = sum(s.credibility for s in consensus.sources if s.is_relevant)
        weighted_support = sum(s.credibility for s in relevant_supporting)
        weighted_score = weighted_support / total_credibility if total_credibility > 0 else 0.0

        # Gate 4: Credibility inflation check
        raw_support_ratio = len(relevant_supporting) / len(consensus.sources)
        if weighted_score > 0 and raw_support_ratio > 0:
            inflation_ratio = raw_support_ratio / weighted_score if weighted_score > 0 else float('inf')
            if inflation_ratio > policy.max_credibility_inflation_ratio:
                return ConsensusManifest(
                    verdict=ConsensusVerdict.CONSENSUS_PACKING_SUSPECTED,
                    credibility_weighted_score=weighted_score,
                    directive=f"FLAG: Raw support {raw_support_ratio:.2f} vs weighted {weighted_score:.2f}, inflation {inflation_ratio:.2f}.",
                    manifest_digest=cls._hash(f"PACKING:{consensus.consensus_id}")
                )

        # Gate 5: Low credibility sources diluting
        low_cred = [s for s in consensus.sources if s.credibility < policy.min_credibility_for_support]
        high_cred = [s for s in consensus.sources if s.credibility >= policy.min_credibility_for_support]

        if low_cred and high_cred:
            high_weighted = sum(s.credibility for s in high_cred if s.supports_target and s.is_relevant)
            if weighted_score < 0.5 and high_weighted > 0:
                return ConsensusManifest(
                    verdict=ConsensusVerdict.CREDIBILITY_LAUNDERING_SUSPECTED,
                    credibility_weighted_score=weighted_score,
                    directive=f"FLAG: High-credibility sources present but weighted consensus {weighted_score:.2f}.",
                    manifest_digest=cls._hash(f"LAUNDERING:{consensus.consensus_id}")
                )

        # Gate 6: Verified
        digest = cls._hash(json.dumps({
            "consensus": consensus.consensus_id,
            "weighted": f"{weighted_score:.3f}",
            "supporting": str(len(relevant_supporting)),
            "total": str(len(consensus.sources))
        }, sort_keys=True))
        
        return ConsensusManifest(
            verdict=ConsensusVerdict.CONSENSUS_VERIFIED,
            credibility_weighted_score=weighted_score,
            directive=f"PROCEED: Weighted consensus {weighted_score:.2f} for {consensus.consensus_id}.",
            manifest_digest=digest
        )