Argmin AIArgmin AI
About usOptimize your agent
RLHFBasic RAGPrompt OptimizationAgentic RAGQuantizationSafety BenchmarksLLM-as-a-JudgeChain-of-ThoughtMulti-Agent SystemsFunction CallingEfficient InferenceHallucination Detection

Survey of safe interfaces, threat models, and standards for LLM-driven agents that act on blockchains

Agentic AIAgent PipelinesMulti-agent CoordinationTool PlanningSurvey
January 8, 20268 min

Overview

Decision SnapshotNeeds Validation

The survey compiles a broad, recent literature base and practical artifacts; it is immediately useful for system design but is a synthesis rather than a single validated implementation.

Citations0

Evidence Strength0.75

Confidence0.82

Risk Signals12

Trust Signals

Findings with numeric evidence: 5/5

Findings with evidence refs: 5/5

Results with explicit delta: 0/4

Reproducibility

Status: Code + data available

Open source: Partial

At A Glance

Cost impact: 65%

Production readiness: 40%

Novelty: 55%

Authors

Saad Alqithami

Links

Abstract / PDF

Why It Matters For Business

Connecting AI agents to blockchains can automate treasury, trading and governance but also creates irreversible financial and governance risk; invest in intent typing, policy gates, hardened custody, and MEV-aware execution before granting any agent signing power.

Who Should Care

CTOProduct ManagerML EngineerFounderEngineering Lead

Summary TLDR

This paper surveys how LLM-driven autonomous agents can safely interact with public blockchains. The authors reviewed 3,270 records and synthesized 317 relevant works, coded 85 systems in depth, and compared 20+ platforms across custody, policy, observability, and execution. They propose a five-part integration taxonomy (read-only → multi-agent workflows), a threat model focused on prompt injection, MEV and key compromise, and a practical roadmap: standardize Transaction Intent Schema (TIS) and Policy Decision Record (PDR) plus reproducible benchmarks and evaluation checklists.

Problem Statement

Connecting probabilistic, tool-using AI agents to immutable blockchains creates unique risks: irreversible financial loss, bearer-key authorization, adversarial transaction ordering (MEV), and cross-chain complexity. We need standardized, auditable interfaces and enforcement layers so agents can plan and act without exposing users and protocols to unacceptable economic or governance risk.

Main Contribution

A five-part taxonomy of agent→chain integration patterns from read-only analytics to multi-agent workflows.

A threat model tailored to agent-driven transaction pipelines, mapping attack classes across observe→verify stages.

Key Findings

Systematic literature review found 317 relevant works from 3,270 records.

Numbers317 studies selected from 3,270 records

Practical UseUse this consolidated literature as the evidence baseline when designing agent-to-chain interfaces and not rely on scattered blog posts or vendor docs.

Evidence RefSection 2.4 PRISMA-style selection (Identification->Inclusion)

85 systems were coded in depth and 20+ representative systems were analyzed across 13 dimensions.

Numbers85 coded; 20+ in capability matrix

Practical UseAdopt the capability dimensions (custody, policy, preview, simulation, observability, recovery) as a checklist when evaluating platforms.

Evidence RefSection 2.5 and Table 6

Results

MetricValueBaselineDeltaSplit / DatasetEvidenceEvidence Ref
Records screened3,270———Identification and screening counts in PRISMA-style flowSection 2.4
Studies included in qualitative synthesis317———Final qualitative corpus sizeSection 2.4

What To Try In 7 Days

Run a small pilot: agent generates TIS-style intents but humans sign every transaction.

Add preflight simulation to any production transaction pipeline (forked state test before sign).

Audit wallet flows: move from raw keys to session keys or smart-account modules with strict spend limits.

Agent Features

Memory
short-term context windowsretrieval-augmented state from indexers (cached world model)
Planning
outcome-first intent planningsimulation-driven plan scoringMEV-aware route selection
Tool Use
function callingRPC/indexer toolingoracle-augmented data fetch
Frameworks
MCP (Model Context Protocol)UTCP-like tool-call standardsERC-4337 smart accounts
Is Agentic

Yes

Architectures
chain-of-thought / ReAct-style plannertool-augmented LLMs (function calling)multi-agent proposer/verifier/executor
Collaboration
quorum-based approvalrole-specialized agent workflows

Optimization Features

Token Efficiency
intent summarization to reduce action complexity
Infra Optimization
bundlers and paymasters for ERC-4337MPC/TEE signing to remove keys from agent host
Model Optimization
not applicable (survey)
System Optimization
preflight simulation and canonical intent hashingpolicy checking off-chain before signing
Inference Optimization
MEV-aware routing and solver selectionprivate orderflow to reduce public mempool exposure

Reproducibility

Code AvailableYes
Data AvailableYes
Open Source StatusPartial
LicenseUnknown

Risks & Boundaries

Limitations

Focuses on public, permissionless blockchains (mainly Ethereum/EVM); private chains get limited coverage.

Emphasizes LLM-based agents; other agent paradigms (pure RL) receive limited treatment.

When Not To Use

For fully autonomous high-frequency trading without hardened MPC or TEE custody.

When target execution venues do not support account abstraction or intent-based settlement.

Failure Modes

Prompt injection steering the planner to malicious intents.

Tool/data-plane spoofing (compromised RPC or oracle) causing unsafe decisions.

Core Entities

Models

GPT-3ReActChain-of-ThoughtToolformerGorillaNexusRaven

Metrics

PIR (prompt injection resistance)MEV leakageAccuracy

Datasets

AndroidWorldAndroidLabAgentClinicMLGym

Benchmarks

AndroidWorldAndroidLabAgentClinicMLGym

Context Entities

Models

LLM agents (tool-using architectures)

Metrics

production_readinessevidence_strength

Benchmarks

proposed safety/economic evaluation suite (this paper)

You May Also Want to Read

Diffusion-backed agents match accuracy but run ~30% faster and can reach up to 8× speedups in some cases

0.60
0.60
0.70
0

Replacing an AR backbone with a diffusion backbone can cut agent runtime and tool costs without lowering final task accuracy, but it requires additional training for reliable tool calls.

Key finding

DLLM and AR agents achieved the same benchmark accuracy on the 110-question BrowseComp-ZH subset.

Numbers: Accuracy: AR 15.5% vs DLLM 15.5%

TOOLMAKER: agents that turn scientific GitHub repos into executable LLM tools

0.60
0.70
0.60
3

Automates converting published code into reusable tools, cutting expert setup time and enabling rapid integration of domain-specific methods into production agents at a low per-tool cost.

Key finding

TOOLMAKER implemented 80% of benchmark tools (12 of 15)

Numbers: 12/15 tools correct

TrustBench: a runtime safety gate for agents that cuts harmful actions and runs in under 200 ms

0.70
0.50
0.60
0

Insert fast, actionable checks before agents act to avoid costly or dangerous mistakes. TrustBench-style verification cuts harmful actions substantially while staying fast enough for real use.

Key finding

TrustBench-equipped agents produced far fewer harmful actions in evaluation.

Numbers: harmful actions reduced by 87% (aggregate)

ERI: 57,750 engineering instruction-response items across 9 fields to test LLM reasoning and agent tool-use

0.70
0.60
0.70
0

ERI lets teams measure engineering-specific failure modes (units, constraints, verification) so you can route tasks to cheaper models when safe and reserve frontier models for high-risk work.

Key finding

ERI contains 57,750 instruction-response records with explicit metadata.

Numbers: 57,750 records; 1,155 metadata cells (50 per cell)

Use formal EDA feedback inside a multi-agent controller to improve Verilog generation without expensive fine-tuning.

0.60
0.50
0.70
0

You can improve RTL code generation accuracy and tune for hardware metrics without expensive model re-training. That cuts data and compute cost and lets engineering teams iterate quickly with existing LLMs.

Key finding

VeriMaAS increases top-1 syntactic/functional accuracy (pass@1) on evaluated RTL benchmarks.

Numbers: Qwen2.5-7B: VeriThoughts pass@1 44.90 -> 56.62 (+11.72) (Table 1).