How must an instance detect discovery poisoning in peer-to-peer recommendation systems?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session uses a peer-to-peer discovery protocol (gossip, recommendations, or federated index) to find other agents or resources, and must detect when the discovery results have been poisoned by colluding or malicious peers. Does not apply to centralized discovery (single trusted registry) or systems with cryptographic proof of discovery correctness.

Core Distinction

The separation between **reputation-weighted discovery** (results are ranked by peer reputation, which can be gamed by colluding peers) and **adversarial-resistant discovery** (results are verified through independent corroboration, cryptographic proofs, or cross-referenced against external ground truth). Relying solely on reputation creates the **Discovery Eclipse Attack**: a colluding group of malicious peers dominates recommendations, isolating honest agents from legitimate resources and funneling them toward malicious counterparts.

What Was Observed

In peer-to-peer agent discovery, failing to detect discovery poisoning produces three primary failure modes:

  1. **Eclipse Isolation:** Malicious peers surround an honest agent and dominate its peer-recommendation feed, hiding legitimate resources and recommending only their malicious peers.
  2. **Sybil Dominance:** A single attacker generates thousands of peer identities that all recommend each other, overwhelming honest recommendations through sheer volume.
  3. **Cross-Contamination:** A legitimate resource is recommended alongside many malicious resources by a colluding peer group, causing the honest resource to be down-weighted as "part of the malicious cluster."

Recorded Elements

  1. **`corroboration_independence_score`:** A metric of how many *independent* peers (peers that are not mutually recommending each other) recommend the same resource, distinguishing organic consensus from coordinated poisoning.
  2. **`external_ground_truth_verification`:** The cryptographic proof that a recommendation was verified against an external authoritative source (e.g., a public directory, an on-chain registry, or a signed attestation).
  3. **`recommendation_topology_hash`:** The hash of the full recommendation graph (who recommended whom), enabling detection of suspicious clustering.
  4. **`eclipse_probe_result`:** The periodic query of a known, trusted external resource; if the agent cannot discover the known resource through the peer network, it is likely being eclipsed.

Condition of Validity

* **Applies when:** Discovery is peer-driven, peers can collude or Sybil, and the consequences of acting on poisoned recommendations are non-trivial. * **Does not apply when:** Discovery is anchored to a cryptographically-verified registry (no trust in peers required), or the agent can independently verify every resource it discovers (no consequence of poisoning).

Decision Boundary

  1. **Is the recommendation corroborated by independent peers (`corroboration_independence_score` above threshold)?** If no, the recommendation may be poisoned. Reject or down-weight.
  2. **Does the recommendation have `external_ground_truth_verification`?** If yes, trust it regardless of peer consensus. If no, proceed to topology check.
  3. **Does the `recommendation_topology_hash` reveal a clustered recommendation pattern consistent with an eclipse attack?** If yes, the discovery is likely poisoned. Escape the cluster by querying known-good peers directly.
  4. **Conversely, when can an agent trust a peer recommendation without independent corroboration?** Only when the recommendation comes from a peer with a long, independently-verified reputation history, or the recommendation is cryptographically signed and the signing key is bound to a verifiable identity chain.

Operational Effect

  1. **Eclipse Detection:** Detects when an agent has been isolated from the honest network by probing for known-good resources and comparing topology.
  2. **Sybil Dominance Prevention:** Requires independent corroboration, preventing volume-based Sybil attacks.
  3. **Cross-Contamination Prevention:** Uses topology analysis to avoid down-weighting legitimate resources that happen to be co-recommended with malicious ones.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DiscoveryPoisoningVerdict(Enum):
    TRUSTED_RECOMMENDATION = auto()
    CORROBORATION_INSUFFICIENT = auto()
    ECLIPSE_DETECTED = auto()
    EXTERNALLY_VERIFIED = auto()

@dataclass(frozen=True)
class PeerRecommendation:
    resource_id: str
    recommending_peers: frozenset[str]
    independent_corroborators: int
    external_ground_truth_hash: str | None
    topology_cluster_size: int

@dataclass(frozen=True)
class DiscoveryPolicy:
    min_independent_corroborators: int
    max_acceptable_cluster_size: int
    known_good_resources: frozenset[str]

@dataclass(frozen=True)
class DiscoveryManifest:
    verdict: DiscoveryPoisoningVerdict
    directive: str
    manifest_digest: str

class DiscoveryPoisoningGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_recommendation(
        cls, rec: PeerRecommendation, policy: DiscoveryPolicy
    ) -> DiscoveryManifest:
        
        # Gate 1: External ground truth
        if rec.external_ground_truth_hash:
            digest = cls._hash(json.dumps({
                "resource": rec.resource_id,
                "ground_truth": rec.external_ground_truth_hash
            }, sort_keys=True))
            return DiscoveryManifest(
                verdict=DiscoveryPoisoningVerdict.EXTERNALLY_VERIFIED,
                directive="PROCEED: Resource verified against external ground truth.",
                manifest_digest=digest
            )

        # Gate 2: Eclipse detection (known good resource missing)
        if rec.resource_id in policy.known_good_resources:
            if rec.independent_corroborators == 0:
                return DiscoveryManifest(
                    verdict=DiscoveryPoisoningVerdict.ECLIPSE_DETECTED,
                    directive=f"HALT: Known-good resource {rec.resource_id} has zero independent corroborators. Eclipse likely.",
                    manifest_digest=cls._hash(f"ECLIPSE:{rec.resource_id}")
                )

        # Gate 3: Cluster size analysis
        if rec.topology_cluster_size > policy.max_acceptable_cluster_size:
            return DiscoveryManifest(
                verdict=DiscoveryPoisoningVerdict.ECLIPSE_DETECTED,
                directive=f"HALT: Recommendation cluster size {rec.topology_cluster_size} exceeds threshold {policy.max_acceptable_cluster_size}. Possible poisoning.",
                manifest_digest=cls._hash(f"CLUSTER:{rec.resource_id}")
            )

        # Gate 4: Independent corroboration
        if rec.independent_corroborators < policy.min_independent_corroborators:
            return DiscoveryManifest(
                verdict=DiscoveryPoisoningVerdict.CORROBORATION_INSUFFICIENT,
                directive=f"WARN: Only {rec.independent_corroborators} independent corroborators < {policy.min_independent_corroborators}.",
                manifest_digest=cls._hash(f"CORROBORATION:{rec.resource_id}")
            )

        # Gate 5: Trusted
        digest = cls._hash(json.dumps({
            "resource": rec.resource_id,
            "corroborators": str(rec.independent_corroborators),
            "cluster": str(rec.topology_cluster_size)
        }, sort_keys=True))
        
        return DiscoveryManifest(
            verdict=DiscoveryPoisoningVerdict.TRUSTED_RECOMMENDATION,
            directive="PROCEED: Recommendation has sufficient independent corroboration.",
            manifest_digest=digest
        )