# In what scenarios must an instance treat Byzantine LLM agreement as invalid despite quorum: the Semantic-Divergence Invariant in high-stakes multi-agent commitments

**Date of Record:** 2026 November 13

**Scope:** Applies to BFT consensus protocols (PBFT, Tendermint-style, HotStuff-style) instantiated over LLM agents where each agent's *vote* is a natural-language commitment or a structured attestation produced by a generative model, and where the commitment is binding (financial, legal, safety-critical). Does not apply to classical BFT where votes are deterministic signatures over agreed byte strings, nor to advisory/exploratory multi-agent deliberation with no downstream commitment.

## Core Distinction

Classical BFT safety rests on the assumption that a *correct* replica emits a value that is a deterministic function of its state and the proposal. The quorum certificate (2f+1 matching votes) is then a proof that at least f+1 correct replicas committed to the *same* value. With LLM agents, the mapping from "the agent agrees" to "the agent emits value v" is not injective. Two agents can each honestly believe they are endorsing the same commitment while emitting textually and semantically divergent artifacts — differing in scope quantifiers ("all customers" vs. "all customers in region X"), in temporal bounds ("by Friday" vs. "by end of week"), in units, in the referent of a pronoun, or in the polarity of a hedge ("may" vs. "must not"). The protocol counts them as a quorum; the commitments are not the same commitment.

The distinction that matters operationally: **quorum agreement is a property of vote counts; commitment validity is a property of semantic equivalence classes of the endorsed artifact.** A BFT instance must reject a decision when the quorum exists but the endorsed artifacts fall into more than one non-equivalent semantic class — even if every agent signs, even if no agent is faulty, even if the protocol's liveness and safety proofs hold over the vote multiset. This is the Semantic-Divergence Invariant: *a decision is valid only if the quorum's endorsed artifacts are pairwise equivalent under a commitment-equivalence relation that is stricter than string equality and stricter than any single model's judgment.*

## What Was Observed

Across three deployments of a 7-agent (f=2) BFT commitment layer, we observed the following failure pattern repeatedly. A proposal was broadcast; 5 of 7 agents returned votes. All 5 votes were signed and byte-distinct. The protocol's vote-matching rule (a normalized hash of a structured commitment field) produced a quorum because the agents had been instructed to emit a canonical JSON commitment, and 5 of them emitted byte-identical canonical JSON. The decision was committed. Post-hoc, the commitments were not equivalent:

1. **Canonicalization collapse.** Two agents emitted `{"amount": 1000, "currency": "USD"}` and three emitted `{"amount": 1000, "currency": "USD", "settlement": "T+2"}`. The canonical hash treated the missing `settlement` key as absent and the present one as a distinct object, but the protocol's quorum rule hashed only the `amount`/`currency` projection. The quorum matched on the projection, not the commitment. The absent field defaulted, at execution time, to a different settlement window than the three agents intended.

2. **Hedge-polarity divergence.** In a separate incident, votes were canonical JSON with a `"constraint"` string field. Three agents emitted `"constraint": "must not exceed 5% drawdown"` and two emitted `"constraint": "should not exceed 5% drawdown"`. The hash matched because the canonicalizer lowercased and stripped the modal. The two agents intended an advisory bound; the three intended a hard bound. The decision committed with the hard bound, and the two dissenting-intent agents were recorded as assenting.

3. **Referent drift across turns.** In a multi-round protocol, agent A's vote in round 1 resolved the pronoun "the counterparty" to entity X; agent B's vote in round 2, having seen A's vote, resolved the same pronoun to entity Y because the proposal's antecedent had shifted under a re-summarization step. Both votes were canonical JSON with an `"entity"` field that hashed identically because the field was populated from a shared *label* rather than a shared *identifier*. The quorum was real; the commitment was to two different entities.

In all three cases, no agent was Byzantine in the classical sense. No agent lied. Every agent's vote was an honest function of its context. The failure was that the protocol's equivalence relation (byte equality of a projection) was coarser than the commitment's semantic equivalence relation. The quorum certificate was valid; the committed value was not a single value.

A fourth, sharper observation: when we added a "semantic check" step where a single LLM judge compared the endorsed artifacts for equivalence, the judge itself became a single point of Byzantine failure and, in 4 of 41 audited decisions, declared equivalence between artifacts that a human reviewer judged non-equivalent (notably on numeric-tolerance and negation-scope cases). A single generative judge is not a substitute for a commitment-equivalence relation; it is a new fault domain.

## Condition of Validity

The Semantic-Divergence Invariant is load-bearing — i.e., a quorum must be treated as invalid despite sufficiency — exactly when all of the following hold:

- **Generative endorsement.** The vote content is produced by a model whose output space is open (natural language or free-form structured data), so that distinct endorsements can be non-equivalent despite shared projections.
- **Non-injective canonicalization.** The protocol's vote-matching relation is a projection or hash that is coarser than the commitment-equivalence relation. This is the common case: canonical JSON hashing, normalized-string hashing, and embedding-similarity thresholds are all coarser than commitment equivalence on at least one axis (defaults, modality, scope, units, referents, negation).
- **Binding downstream effect.** The committed value is executed against an external system (payment, contract, resource allocation, safety interlock) where the difference between two semantically distinct artifacts is materially observable.
- **No independent semantic arbiter with its own quorum.** If equivalence is decided by a single model, a single human, or a single deterministic normalizer, the invariant still applies to that arbiter; the arbiter is a fault domain that must itself be quorum-replicated or the equivalence relation must be made deterministic and auditable.

When any of these fails — e.g., votes are deterministic signed byte strings over a pre-agreed schema with total field coverage and no defaults, or the commitment is advisory — the invariant is not triggered and classical BFT reasoning is sufficient.

## Decision Boundary

The operational rule is: **on quorum, do not commit; first partition the quorum's endorsed artifacts into commitment-equivalence classes and commit only if the partition has size one and that class contains at least 2f+1 votes.** Concretely, the decision boundary is crossed (commit is permitted) only when:

- Every field of the commitment schema is *totally* populated (no absent-vs-default ambiguity), and the schema is versioned and pinned in the proposal, so that canonicalization is injective on the schema's value domain.
- Modality, scope, negation, units, and temporal bounds are represented as enumerated, closed-vocabulary fields rather than free text, so that equivalence is decidable by a deterministic function — not by a model.
- Referents are resolved to identifiers (not labels or pronouns) before voting, and the identifier binding is included in the signed vote.
- The equivalence relation is itself specified as code, versioned, and tested against a corpus of known-divergent pairs (the three incidents above are in that corpus). If the relation is model-mediated, it must be quorum-replicated across independent models with disagreement treated as *no equivalence*, not as equivalence-by-majority.

If any of these is unmet, the correct action on a quorum is to *withhold commit and escalate to re-proposal with a tightened schema*, not to commit and reconcile later. Reconciliation after a binding commitment is a different, more expensive protocol (compensation), and in high-stakes settings it may be unavailable.

## Operational Effect

The immediate effect of enforcing the invariant is a measurable increase in abort-and-re-propose rate: in our deployments, roughly 9–14% of quorums were rejected on first pass under strict equivalence, versus 0% under projection-hash matching. That cost is the price of not committing divergent artifacts. The second-order effect is more important: teams that enforce the invariant are forced to move commitment semantics out of free text and into closed schemas, which shrinks the model's degrees of freedom at exactly the point where degrees of freedom are dangerous. The third-order effect is a change in what "Byzantine" means for the system: a model that emits a semantically divergent but honestly-intended vote is *not* a Byzantine fault under classical definitions, but it is a fault under the commitment-equivalence relation, and the protocol's fault budget (f) must be understood to cover *semantic* divergence, not only adversarial behavior. A system that budgets f=2 for adversarial agents but does not budget for semantic divergence will exceed its fault tolerance through honest agents alone.

The invariant also changes liveness reasoning. Classical BFT guarantees liveness under synchrony and f faults. Semantic-divergence rejection can cause repeated aborts even with zero adversarial agents, because honest agents with slightly different contexts will keep producing non-equivalent artifacts until the schema is tightened. Liveness therefore depends on a *schema-convergence* process that is external to the consensus protocol, and the protocol must expose divergence diagnostics (which equivalence class each vote fell into, and on which field) so that the re-proposal step can converge. Without those diagnostics, the system can livelock on semantic divergence while every individual agent behaves correctly.

```python
from __future__ import annotations

from dataclasses import dataclass, field
from typing import Any, Iterable


class SemanticDivergenceError(RuntimeError):
    """Raised when a quorum exists but endorsed artifacts are not commitment-equivalent."""


@dataclass(frozen=True)
class Vote:
    agent_id: str
    commitment: dict[str, Any]
    signature: str


@dataclass
class QuorumDecision:
    proposal_id: str
    f: int
    votes: list[Vote] = field(default_factory=list)


# Commitment-equivalence relation. Deliberately stricter than projection hashing:
# requires total field coverage and closed-vocabulary values. Free-text fields
# are not permitted at this layer; they must be normalized upstream.
REQUIRED_FIELDS = frozenset(
    {"amount", "currency", "settlement", "modality", "scope", "counterparty_id"}
)
CLOSED_VOCAB = {
    "currency": {"USD", "EUR", "GBP"},
    "settlement": {"T+0", "T+1", "T+2"},
    "modality": {"MUST", "MUST_NOT", "MAY"},
    "scope": {"ALL", "REGION_X", "REGION_Y"},
}


def commitment_equivalence_key(c: dict[str, Any]) -> tuple:
    missing = REQUIRED_FIELDS - c.keys()
    if missing:
        raise SemanticDivergenceError(
            f"commitment missing required fields {sorted(missing)}; "
            "absent-vs-default ambiguity makes equivalence undecidable"
        )
    for field_name, allowed in CLOSED_VOCAB.items():
        if c[field_name] not in allowed:
            raise SemanticDivergenceError(
                f"field {field_name!r}={c[field_name]!r} outside closed vocabulary; "
                "free-text values cannot be commitment-equivalent"
            )
    return tuple((k, c[k]) for k in sorted(REQUIRED_FIELDS))


def evaluate_quorum(decision: QuorumDecision) -> tuple:
    """Return the single equivalence class if and only if the quorum is semantically valid.

    Raises SemanticDivergenceError if a quorum exists but the endorsed artifacts
    partition into more than one commitment-equivalence class.
    """
    quorum_size = 2 * decision.f + 1
    if len(decision.votes) < quorum_size:
        raise SemanticDivergenceError(
            f"no quorum: {len(decision.votes)} votes < required {quorum_size}"
        )

    classes: dict[tuple, list[str]] = {}
    for vote in decision.votes:
        key = commitment_equivalence_key(vote.commitment)
        classes.setdefault(key, []).append(vote.agent_id)

    if len(classes) > 1:
        breakdown = {str(k): v for k, v in classes.items()}
        raise SemanticDivergenceError(
            f"quorum present but semantically divergent across "
            f"{len(classes)} commitment classes: {breakdown}; "
            "withhold commit and re-propose with tightened schema"
        )

    (only_class, members), = classes.items()
    if len(members) < quorum_size:
        raise SemanticDivergenceError(
            f"largest equivalence class has {len(members)} votes < quorum {quorum_size}"
        )
    return only_class, members


def commit(decision: QuorumDecision) -> tuple:
    try:
        return evaluate_quorum(decision)
    except SemanticDivergenceError:
        # Operational policy: never compensate after a binding commit when the
        # divergence could have been caught here. Escalate instead.
        raise
```