DualTrust gates AI agent tool calls in 47 microseconds, swapping LLM judges for Bayesian reputation and cryptographic audit

When an agent invokes an external API, reserves a small financial quota or drives a physical actuator, the authorization verdict can be made in tens of microseconds instead of placing an LLM classifier on the critical path. Existing safety guardrails depend on secondary LLM-as-a-judge classifiers that add 400 to 850 milliseconds of runtime latency and recurring token cost, while static role-based access control fails against continuous behavioral drift and salami-slicing violations. In the in-memory core tier, DualTrust's median verdict latency was 47.10 microseconds, mean 63.16 microseconds and p99 287.10 microseconds; the comparison NeMo Guardrails and Llama Guard 3 (8B) medians of 390 and 810 milliseconds come from published literature and vendor figures and were not re-measured on the same hardware.

The system splits the human principal's accountable credit from the software agent's behavioral standing, so a hijacked agent has only its execution privileges quarantined. Existing frameworks either miss cumulative trespass or penalize the human principal's identity rather than constraining the rogue software entity. Agent standing is the expectation of a Beta distribution, starting at a neutral 0.50 and partitioned at thresholds 0.70, 0.40 and 0.20 into verified, probation, restricted and quarantined tiers; the penalty is $\Delta\beta = k_p (sev \cdot c^2)(\max(1,v_a))^{1.8}$, and any single infraction resets the clean-streak counter to zero.

Under the chosen parameters, salami-slicing attacks are quarantined within a finite number of cycles, and collusive low-standing accounts cannot drag down a verified agent with negative reports. In linear reputation systems, an attacker alternating compliant tasks with mild infractions kept an average standing above 0.82 indefinitely. In the $sev=2.0$ simulation, the salami slicer's standing fell from 0.9153 to 0.5745 after the first strike, to 0.2638 after the second and to 0.1300 after the third, below the 0.20 quarantine line; 50 probation bots filing maximum-severity reports against a verified agent at 0.98 produced a penalty of exactly 0.0.

Evaluation ran on a single Windows 11 workstation with deterministic attack algorithms and Monte Carlo cycles, locally measured static RBAC and AST-validation baselines, and neural-guardrail figures taken from published literature; it has not been validated on live LLM agents, and the author lists multi-turn agentic environments as future work.

The author states that penalties are only as reliable as the infraction oracles, so undetected infractions go unpunished; because negative evidence never decays, persistent framing below the attribution threshold still accumulates penalties; when attack cycles are not shorter than the 20-action recovery window, penalties degrade toward linear and a full analysis is left to future work; the audit ledger and signing key share one host, giving tamper evidence rather than non-repudiation.