Pratyahara: A Neural Tissue Defense Model for Detecting Compromised Agents in Multi-Agent Networks

Multi-agent networks built on the Agent2Agent (A2A) protocol [5] and Model Context Protocol (MCP) [6] have a gap that perimeter defense cannot close: agents whose behavior drifts over time due to adversarial compromise, reinforcement learning misalignment, self-healing side effects, or model update artifacts. Research shows that a majority of large language models can be manipulated through inter-agent communication, with attack success rates exceeding 80% before mitigation [1]. Session smuggling [2], tool poisoning [3], and emergent collusion all operate inside the network boundary where input filtering is structurally blind. We propose the NERVE specification, five primitives for detecting and responding to behavioral drift in multi-agent networks. The design draws on the brain's neural tissue defense mechanisms, which are intent-agnostic: they detect deviation from baseline regardless of whether the cause is malicious, accidental, or emergent. NERVE extends the A2A and MCP protocols without requiring changes to either core specification and is analyzed against eight documented attack vectors. ## v2 — changes from v1 1. **Canonical fingerprint algorithm (§3.1).** v1 left the canonical serialization of `behavioral_fingerprint` unspecified, so two compliant observers could compute different digests for the same embedding. v2 pins it (`FINGERPRINT_VERSION = "v1"`: 6-decimal banker's rounding, whitespace-free JSON, `nerve-fp/v1` domain tag, SHA-256 → `sha256:<hex>`). 2. **Invariant AN-3 (Fingerprint Determinism, new).** Once published, `behavioral_fingerprint` MUST NOT change without a paired `RebaselineFingerprint` event; encoded in the TLA+ spec and TLC-checked. 3. **`NeuralPostureRef` typed schema (§6.1).** The AgentCard `capabilities.extensions[].params` payload is now a normative typed object; v1 showed it by example only. 4. **Manifest discoverability (§6.1).** NERVE now publishes an `ExtensionManifest` (JSON Schema) at its URI so third-party validators can validate declared NERVE payloads without NERVE-specific code. 5. **Companion extension, Yathartha (§6.3).** A brief pointer to the companion Yathartha paper was added — coverage-conditional drift detection and invariants N-16 through N-18. The full capability-surface specification lives in that separate paper, not here, so each result has a single canonical home. 6. **Related work + references.** Added a comparison with MI9 (§8) and references [24]–[26] (jagged-frontier, Yathartha, MI9). No breaking changes to the wire format; existing implementations remain conformant. NERVE Core (invariants N-1 through N-15) is unchanged. (Note: `FINGERPRINT_VERSION = "v1"` above is the fingerprint-algorithm version tag, unrelated to the Zenodo record version.)