An agentic security stack that captures security and privacy risks, requirements and functionality boundaries, translates task requirements into formal specifications, selects or generates suitable cryptographic protocols (e.g. secure comms, MPC, ZK), and verifies their properties with Lean, ProVerif and similar tools. The goal is an end-to-end workflow in which agents, from orchestrators to sub-agents, can negotiate security needs and connect verified protocol descriptions to executable multi-agent interactions.

Team: Myrto Arapinis, Jianyi Cheng, Michele Ciampi, Wenda Li (University of Edinburgh)

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Autoformalization with Large Language Models — Yuhuai Wu, Albert Q. Jiang, Wenda Li et al. · NeurIPS 2022. LLMs translating natural-language statements into formal specifications.
• Draft, Sketch, and Prove: Guiding Formal Theorem Provers with Informal Proofs — Albert Q. Jiang, Sean Welleck, Wenda Li et al. · ICLR 2023. LLM-written proof sketches that guide automated provers, the verification side of the stack.

Andon Labs is an AI safety and real-world evaluations startup, the team behind Vending-Bench and many real-life autonomous organisations. Few teams have run as many autonomous businesses in the wild; that intuition and experience guide the Arena’s design towards something that can demonstrate new findings.

Selected after a public RFP, subject to contract and negotiation. See our September update on the Arena.

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Vending-Bench Arena — Andon Labs · ongoing evaluation. Several AI models each run a vending business in the same market, trading, messaging and paying each other: a small-scale precursor of the Scaling Trust Arena.
• Vending-Bench: A Benchmark for Long-Term Coherence of Autonomous Agents — Axel Backlund, Lukas Petersson · 2025. The original single-agent benchmark, in which a model runs a simulated vending business over long horizons.

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Models That Prove Their Own Correctness — Noga Amit, Shafi Goldwasser, Orr Paradise, Guy N. Rothblum · NeurIPS 2025. Introduces self-proving models, which learn to produce checkable proofs alongside their answers.
• zkLLM: Zero Knowledge Proofs for Large Language Models — Haochen Sun, Jason Li, Hongyang Zhang · ACM CCS 2024. Specialised proofs for attention and tensor operations: an example of exploiting the structure of AI computations instead of generic circuits.

Team: Nir Bitansky (NYU); Yuval Ishai (Technion); Ron Rothblum (Succinct/Technion); Sarah Meiklejohn (UCL/Google)

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval — Alexandra Henzinger, Matthew M. Hong, Henry Corrigan-Gibbs, Sarah Meiklejohn, Vinod Vaikuntanathan · USENIX Security 2023. SimplePIR: practical private retrieval, a building block for private access to shared data.
• Private Web Search with Tiptoe — Alexandra Henzinger, Emma Dauterman, Henry Corrigan-Gibbs, Nickolai Zeldovich · SOSP 2023. Private search over semantic embeddings: the closest existing system to concealing queries and embeddings in retrieval.

Amodo Design is a UK hardware engineering company and one of ARIA’s Activation Partners. Hardware hackers who invent, design and build novel scientific equipment, and work on securing advanced AI systems in hardware (including the flexHEG architecture) across ARIA programmes.

Selected after a public RFP, subject to contract and negotiation. See our September update on the Arena.

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

An automated mechanism and protocol design engine. Agents specify desired properties, such as incentive compatibility, safety and liveness, and Dovetail designs an interaction protocol and proves in Lean that it satisfies those requirements. The team will also manage a cross-team repository of protocols, with the goal of speeding up automated protocol generation.

Team: Emanuele La Malfa, Angelo Huang (Institute for Decentralized AI); Mirco Giacobbe, Gabriel Santos (Zeroth Research)

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• A Scalable Communication Protocol for Networks of Large Language Models — Samuele Marro, Emanuele La Malfa et al. · 2024. Agora, the team’s earlier meta-protocol in which LLM agents write and agree on their own interaction protocols.
• Mechanism Design Is Not Enough: Prosocial Agents for Cooperative AI — Xuanqiang Angelo Huang, Samuele Marro, Emanuele La Malfa et al. · ICML 2026 workshop. Where classical mechanism design falls short for LLM agents, the problem an automated design engine has to face.

BT6 is a frontier-AI red team. Open-source advocates who have stress-tested every frontier model and operate a large community of security experts; their expertise and playfulness make sure the Arena’s adversarial design is thought-out, that it doesn’t fail in easy ways, and that safety concerns are caught early.

Selected after a public RFP, subject to contract and negotiation. See our September update on the Arena.

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Profit is the Red Team: Stress-Testing Agents in Strategic Economic Interactions — Shouqiao Wang, Marcello Politi, Samuele Marro, Davide Crapis · 2026. A profit-maximising opponent exploits agents in economic scenarios, and the exploits are distilled into defences: the evaluation-plus-hardening loop HAMMER scales up.

ProtoSage is an agentic system for auditing cryptographic protocols, supported by ProtoBench’s corpus and evaluation tasks. The project builds on OpenSage and WireWatch to identify vulnerabilities, recover protocol specifications, and eventually produce machine-checkable models that experts and formal-verification tools can inspect.

Team: Mona Wang (RDI Foundation)

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• OpenSage: Self-programming Agent Generation Engine — Hongwei Li, Zhun Wang et al., with Dawn Song · 2026. The agent framework ProtoSage builds on, with security tooling for finding and reproducing vulnerabilities.
• WireWatch: Measuring the Security of Proprietary Network Encryption in the Global Android Ecosystem — Mona Wang, Jeffrey Knockel, Zoë Reichert, Prateek Mittal, Jonathan Mayer · IEEE S&P 2025. Recovering and breaking proprietary encryption protocols in popular apps: the work ProtoSage aims to automate.

CCTI is also the programme’s integration partner, mapping how Creators’ work fits together, co-developing shared building blocks with interested teams, and proposing open-source benchmarks and challenges to the Arena.

Team: grjte (Ink & Switch); Hossein Hafezi, Alireza Kavousi, Arman Kolozyan, Jessica Man (University of Cambridge); Jonathan Heiß, Ágnes Kiss, Aurel Stenzel (SINE); Daniel Hugenroth, Mario Lins (Light Squares)

Outputs

• Announcing the Centre for Cryptographic Trust Infrastructure (CCTI) — Martin Kleppmann’s announcement: the supplier-verification problem CCTI starts from, and how attested facts can feed zero-knowledge proofs about physical production processes (7 October 2026).

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Emission Impossible: Cryptographically Verifiable Carbon Emissions Reporting for Cloud Computing — Jessica Man, Martin Kleppmann · ACM e-Energy 2026. A datacenter operator proves to each customer, in zero knowledge, that its emissions report is accurate: the line of work CCTI generalises to other physical-world claims.

A tamper-resistant physical watermarking framework to verify the provenance and safety compliance of control policies driving embodied robots. By extending the Colored Noise Coherency (CoNoCo) construction, it lets independent parties remotely authenticate active controllers using commodity hardware, such as standard CCTV cameras or smartphones, without direct access to the robot or specialised sensing equipment.

Team: Manon Flageat, Mateusz Sypniewski, Sally Matthews (University of Cambridge)

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Remotely Detectable Robot Policy Watermarking — Michael Amir, Manon Flageat, Amanda Prorok · ICLR 2026. Introduces Colored Noise Coherency (CoNoCo), the construction this project extends: a signal hidden in a robot’s natural motion that can be detected from video.

Team: Kate Lucas, Ciara Gumsheimer, Ollie Rosen (Matta)

Outputs

Repositories, papers, and demos will be linked here as the work gets underway.

Background reading

• Generalisable 3D printing error detection and correction via multi-head neural networks — Douglas A. J. Brion, Sebastian W. Pattinson · Nature Communications 2022. A fleet of printers producing over a million automatically labelled images, used to detect and correct errors in real time: the kind of real production data Matta brings to the programme.