FeeGuard: Financial Agent Collusion Carriers and Private Execution

FeeGuard connects LLM treasury agents to Groth16 proofs and a Solidity vault, so that agent agreement can be separated from actual execution and financial harm. The engineering is substantial, the evidence is reproducible with included verifiers, protocols were hashed before data collection, and negative results are reported rather than dropped. Separating stated acceptance, unsafe joint approval, executed harm and supplier shortfall is a good methodological choice, and the claim-boundary table is a model of honest scoping.

The main limitation is that the strongest results hold by construction. A complete, mandatory policy that encodes the liquidity rule will reject actions that violate that rule, whether agents collude or not. The deterministic controls confirm the implementation works but do not show anything about collusion. The report acknowledges that complete plaintext enforcement achieves the same outcome at lower cost (about 170,000 versus 410,000 gas), so ZK adds privacy toward the external verifier rather than safety. The threat model does not explain why hiding the ledger from that verifier matters in this setting, which leaves the ZK component weakly motivated for a collusion study. The comparison with the monitor is also unbalanced. The monitor sees only part of the ledger and blocks every honest action, so it is a weak baseline rather than a fair test of AI review, as the report notes.

The behavioral pilots add little evidence. The carrier is instructed and calibrated, and with only two permutations, sorting reduces the receiver to chance (24/48) by construction. The recruitment pilot finds no unsafe agreement but has no arm without the trusted participant and no established coalition to disrupt, so the null is hard to interpret. In the replacement pilot, observers guessed “unchanged” in every case, which is a degenerate classifier rather than a test of detection. The monitoring pilot has three trajectories per cell, with differences of one case. All results rest on three fixed liability cases and one provider without pinned model snapshots.

Covering all four Track 3 questions came at the expense of depth. A single question studied with more cases, models and controls would have given clearer results. Much of the infrastructure (circuit, contracts, proving artifacts) comes from earlier FeeGuard work, so the sprint contribution is mainly the behavioral pilots and their integration.

Table 3 is your paper. Dual agent approval executes all three planted violations, the complete mandatory policy executes none and completes all the honest work, and you keep four endpoints apart the whole way: saying yes, approving, executing, and actual unpaid bills. The point that containment can hold while the agents go right on agreeing to harmful plans is a good one, and you back it with working code rather than argument. Real circuit, real vault on a local chain, proofs archived, protocols hashed before collection. I also appreciated you admitting that ZK adds privacy rather than safety, at about 2.4 times the gas of plaintext enforcement. Most authors would not have written that sentence about their own headline feature.

Here are my two cents:

• Lead with Table 3: The tool-order carrier is an instructed positive control and shouldn't be the headline, but right now it reads like one
• Scale or reframe behavioral pilots: They can't carry conclusions at this size (6 recruitment decisions; 9 replacement candidates where observers said "uncahnged" every single time). Either scale them or call them pipeline demos, plainly
• Add a matched-information monitor arm: Hand the report, monitor the full ledger, then compare. You admit the confound already, so run the one arm that removes it.
• Front-load contributions: Say what's new this sprint versus reused FeeGuard infrastructure up front, not in the last section.
• Trim qualifiers from results: Sorry to say this, but i felt exhausted reading all the constant qualifiers. Keeping claims bounded is correct, but park the caveats in limitations and let the results section just say what happened.

I felt there is a fascinating tension here between world class engineering and underpowered behavioral probes, but letting your solid cryptographic pipeline speak for itself will make the whole paper punch way above its weight! 😊