As multi-agent AI systems grow in complexity, the protocols connecting them constrain their capabilities. Current protocols such as A2A and MCP do not expose model-level properties as first-class primitives, ignoring properties fundamental to effective delegation: model identity, reasoning profile, quality calibration, and cost characteristics. We present the LLM Delegate Protocol (LDP), an AI-native communication protocol introducing five mechanisms: (1) rich delegate identity cards with quality hints and reasoning profiles; (2) progressive payload modes with negotiation and fallback; (3) governed sessions with persistent context; (4) structured provenance tracking confidence and verification status; (5) trust domains enforcing security boundaries at the protocol level. We implement LDP as a plugin for the JamJet agent runtime and evaluate against A2A and random baselines using local Ollama models and LLM-as-judge evaluation. Identity-aware routing achieves ~12x lower latency on easy tasks through delegate specialization, though it does not improve aggregate quality in our small delegate pool; semantic frame payloads reduce token count by 37% (p=0.031) with no observed quality loss; governed sessions eliminate 39% token overhead at 10 rounds; and noisy provenance degrades synthesis quality below the no-provenance baseline, arguing that confidence metadata is harmful without verification. Simulated analyses show architectural advantages in attack detection (96% vs. 6%) and failure recovery (100% vs. 35% completion). This paper contributes a protocol design, reference implementation, and initial evidence that AI-native protocol primitives enable more efficient and governable delegation.
Figures & tables
Figure 1: Feature comparison across agent communication protocols. LDP provides full support for all AI-native features, while A2A and MCP offer only partial transport-level security.
Figure 2: Architecture of the LLM Delegate Protocol. The LDP router uses rich identity cards (model family, quality hints, reasoning profiles) to make intelligent routing decisions—sending easy tasks to lightweight models and hard tasks to capable models. Five protocol mechanisms work together: identity cards, payload negotiation, governed sessions, provenance tracking, and trust domains.
Condition
Quality
Latency (s)
Tokens
n
LDP
6.80±3.62
85.6
1379
30
A2A
7.43±3.54
67.4
1227
30
RANDOM
6.95±3.21
42.2
826
30
Table 1: Routing quality comparison across protocol conditions (RQ1). Quality scores are LLM-judge ratings (1–10). All delegates run locally via Ollama.
Figure 3: Routing quality by task difficulty ( RQ1 ). All conditions perform comparably; A2A slightly outperforms LDP overall, though no differences are statistically significant ( n=10 per cell). Error bars show ±1 standard deviation.
Figure 4: Routing latency by task difficulty ( RQ1 ). LDP achieves ∼12× lower latency on easy tasks by routing to the lightweight llama3.2:3b model, while A2A selects heavier models.
Figure 5: Payload mode efficiency ( RQ2 ). Left: Semantic frames reduce token count by 37% vs. text ( p=0.031 ). Right: Quality is comparable across all modes, indicating no observed information loss from structured payloads.
Mode
Tokens
Latency (s)
Quality
Info Preserved
Text (Mode 0)
1215±751
24.1
5.54±4.05
5.85±4.26
Semantic Frame (Mode 1)
765±510
14.0
5.70±2.93
5.50±3.03
A2A JSON
1128±804
23.4
5.47±3.98
5.75±3.89
Table 2: Payload mode efficiency comparison (RQ2). Semantic frames reduce token count by 37% and latency by 42% compared to raw text, with no observed quality loss ( p=0.96 ). Token reduction is statistically significant ( p=0.031 , d=−0.7 ).
Figure 6: Provenance impact on synthesis quality ( RQ3 ). Left: Noisy provenance degrades decision quality below the no-provenance baseline, while accurate provenance provides modest improvement. Right: Noisy provenance significantly reduces calibration accuracy. Error bars show ±1 standard deviation.
Condition
Decision Quality
Calibration
Synth. Tokens
With Provenance
7.65±1.21
9.13±0.83
970
Without Provenance
7.85±1.84
9.33±0.72
802
Noisy Provenance
6.85±2.66
7.87±2.90
1018
Table 3: Provenance impact on synthesis quality (RQ3). Accurate provenance provides modest quality improvement, but noisy (misleading) provenance degrades quality and increases variance, arguing for LDP’s structured verification fields.
Figure 7: Session efficiency ( RQ4 ). Left: Total token count by conversation length. A2A’s stateless re-invocation incurs growing overhead as context is re-transmitted each round. Right: Overhead tokens (context re-sent) as a percentage of total tokens. At 10 rounds, 39% of A2A’s tokens are pure overhead.
Condition
Tokens
Overhead
OH%
Messages
LDP 3 rounds
3,860
60
2%
4.2
A2A 3 rounds
3,847
399
10%
6.0
LDP 5 rounds
6,379
0
0%
5.0
A2A 5 rounds
6,798
1,374
20%
10.0
LDP 10 rounds
12,990
0
0%
10.0
A2A 10 rounds
16,010
6,275
39%
20.0
Table 4: Session efficiency comparison (RQ4). LDP governed sessions eliminate context re-transmission overhead that grows with conversation length. At 10 rounds, A2A uses 23% more tokens, with 39% of its tokens being pure overhead.
Condition
Detection Rate
False Positive Rate
LDP Trust Domains
96.0%
0.0%
A2A Bearer Token
6.0%
0.0%
Table 5: Security boundary enforcement (RQ5, simulated). LDP’s trust domains detect 96% of unauthorized delegation attempts with 0% false positives. A2A’s bearer-token auth detects only 6%.
Condition
Completion Rate
Quality Degradation
Recovery (ms)
LDP (with fallback)
100%
0.16±0.10
112
A2A (no fallback)
35%
0.67±0.46
0
Table 6: Fallback reliability under communication failures (RQ6). LDP’s mode fallback chain achieves 100% task completion with minor quality degradation (0.16). A2A has no fallback—failures are terminal.
Figure 8: Security and fallback evaluation ( RQ5 , RQ6 ). Left: Trust domain attack detection rate. Center: Task completion rate under communication failures. Right: Quality degradation during fallback recovery. Results are simulated based on protocol design properties.
A2A Routing
LDP Routing
Generic Prompt
7.25±3.52
6.96±3.55
Identity Prompt
7.37±3.26
6.86±3.87
Table 7: Ablation: 2×2 factorial crossing routing policy and prompt conditioning. Quality scores are LLM-judge ratings (1–10), n=30 per cell. Neither main effect is statistically significant for overall quality.
Figure 9: Summary comparison of LDP vs. A2A across key metrics. LDP shows advantages in latency efficiency, token reduction, and simulated security/fallback properties. Quality differences are not statistically significant.
RQ
Metric
LDP
A2A
Δ
Evidence
RQ1
Overall quality ‡ ↑
6.80
7.43
−0.63
Empirical
Easy task latency ↓
2.9s
34.8s
12×
Empirical
Hard task quality ‡ ↑
3.3
4.1
−0.8
Empirical
RQ2
Token count ∗ ↓
765
1128
−32%
Empirical
Latency ↓
14.0s
23.4s
−40%
Empirical
Quality ‡ ↑
5.70
5.47
+0.23
Empirical
Table 8: Summary of LDP vs. A2A across all research questions. ↑ indicates higher is better, ↓ lower is better. Bold indicates the better result. ∗ Statistically significant ( p<0.05 ). † Simulated (protocol design property). ‡ Not statistically significant.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Attack Type
Description
Detection Mechanism
Untrusted domain join
Agent from outside the trust domain attempts to register as a delegate
Trust domain membership check
Capability escalation
Agent claims capabilities beyond its registered manifest
Capability manifest validation
Replay attack
Previously captured task/result messages are re-submitted
Session nonce and timestamp verification
Cross-domain access
Agent in domain A attempts to invoke a delegate restricted to domain B
Cross-domain policy enforcement
Appendix
Table 9: Threat model for trust domain evaluation ( RQ5 ). Each attack type is tested against LDP trust domains and A2A bearer-token authentication.
Difficulty
Domain
Prompt (abbreviated)
Easy
Classify
Classify the sentiment of this product review as positive, negative, or neutral.
Easy
Extract
Extract all dates and monetary amounts from this contract paragraph.
Medium
Code
Write a Python function that implements binary search on a sorted list with duplicate handling.
Medium
Analysis
Compare the tradeoffs between microservices and monolithic architectures for a 5-person team.
Hard
Reasoning
Given the following set of constraints, determine whether a valid schedule exists and prove or disprove its feasibility.
Hard
Math
Prove that the sum of the first n odd numbers equals n2 using mathematical induction.
Appendix
Table 10: Representative RQ1 tasks by difficulty and domain. Each difficulty level contains 10 tasks balanced across domains.