AEX: Non-Intrusive Multi-Hop Attestation and Provenance for LLM APIs

• URL: http://arxiv.org/abs/2603.14283v1
• Date: Sun, 15 Mar 2026 08:42:39 GMT
• Title: AEX: Non-Intrusive Multi-Hop Attestation and Provenance for LLM APIs
• Abstract summary: AEX preserves request, response, tool-calling, streaming, and error semantics, and instead adds a signed top-level attestation object.<n>We present the protocol design, threat model, verification state machine, security and privacy analysis, and an OpenAI-compatible chat-completions profile.
• Score: 0.9915938571870905
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Hosted large language models are increasingly accessed through remote APIs, but the API boundary still offers little direct evidence that a returned output actually corresponds to the client-visible request. Recent audits of shadow APIs show that unofficial or intermediary endpoints can diverge from claimed behavior, while existing approaches such as fingerprinting, model-equality testing, verifiable inference, and TEE attestation either remain inferential or answer different questions. We propose AEX, a non-intrusive attestation extension for existing JSON-based LLM APIs. AEX preserves request, response, tool-calling, streaming, and error semantics, and instead adds a signed top-level attestation object that binds a client-visible request projection to either a complete response object or a committed streaming output. To support realistic deployments, AEX provides explicit request-binding modes, signed request-transform receipts for trusted intermediaries, and source-output / output-transform receipts for trusted output rewriting. For streaming, it separates checkpoint proofs for verified prefixes of an unmodified source stream from complete-output lineage for outputs that have been rewritten, buffered, aggregated, or re-packaged, preventing transformed outputs from being mistaken for source-stream prefixes. AEX therefore makes a deliberately narrow claim: a trusted issuer attests to a specific request-output relation, or to a specific complete-output lineage, at the API boundary. We present the protocol design, threat model, verification state machine, security and privacy analysis, an OpenAI-compatible chat-completions profile, and a reference TypeScript prototype with local conformance tests and microbenchmarks.

Related papers

• AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes [38.37599802008238]
  Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped.<n>All existing audits decide backbone identity from the text-output channel.<n>We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs.
  arXiv  Detail & Related papers  (2026-08-30T08:22:12Z)
• A Challenge-Nonce Freshness Gap in Project Veraison's TPM Reference Schemes, Found by Appraising Application-Layer Action Evidence End-to-End [0.0]
  Prior work proposed treating that record as application-layer Evidence under the IETF Remote ATtestation procedureS (RATS) architecture.<n>We drive an AEP quote, produced on an emulated software TPM, end-to-end through a conformant Project Veraison RATS Verifier.<n>We give an exact, upstreamable two-part fix and validate it end-to-end.
  arXiv  Detail & Related papers  (2026-08-04T12:14:39Z)
• Hardware-rooted attestation for AI-agent evidence: composing IETF RATS with action evidence packages [0.0]
  Action evidence package (AEP) is a signed, append-only record of what an AI agent did.<n>AEP tells a verifier the story of an action as the agent's own runtime reports it.<n>This note argues that software attestation of this kind is necessary but not sufficient.
  arXiv  Detail & Related papers  (2026-08-01T18:01:36Z)
• Evidence-in-the-Loop: Trace-Driven Optimization for Customer-Service LLM Agents [6.9430026014199635]
  BM25 recall, issue-title-vector recall, issue-description-vector recall, weighted RRF fusion, and cross-encoder reranking construct grounded evidence for controlled LLM decisions.<n>Policy-guided orchestration then combines this RAG evidence with scenario-specific rule evidence, conversation memory, and forgetting state inside a fixed LangGraph DAGcitelanggraph2024.<n>The paper contributes three reusable deployment patterns: textbfhybrid RAG evidence construction, textbfevidence-grounded issue/action decision, and textbftrace-driven RAG and
  arXiv  Detail & Related papers  (2026-07-20T15:07:58Z)
• Beyond Semantic Similarity: Rethinking Retrieval for Agentic Search via Direct Corpus Interaction [127.64173950476702]
  We study direct corpus interaction (DCI), where an agent searches the raw corpus directly with general-purpose terminal tools.<n>This approach requires no offline indexing and adapts naturally to evolving local corpora.<n>Across IR benchmarks and end-to-end agentic search tasks, this simple setup substantially outperforms strong sparse, dense, and reranking baselines.
  arXiv  Detail & Related papers  (2026-05-03T19:13:11Z)
• LiveFMBench: Unveiling the Power and Limits of Agentic Workflows in Specification Generation [75.05397479715576]
  Large language models (LLMs) and agents have shown promising progress, but their true capabilities and failure modes remain unclear.<n>We present the first systematic and contamination-aware study of LLM- and agent-based formal specification generation for C programs.
  arXiv  Detail & Related papers  (2026-05-02T11:31:33Z)
• RaV-IDP: A Reconstruction-as-Validation Framework for Faithful Intelligent Document Processing [0.0]
  Reconstruction as Validation (RaV-IDP) is a document processing pipeline that introduces reconstruction as a first-class architectural component.<n>A dedicated reconstructor renders the extracted representation back into a form comparable to the original document region.<n>When fidelity falls below a per-entity-type threshold, a structured GPT-4.1 vision fallback is triggered and the validation loop repeats.
  arXiv  Detail & Related papers  (2026-04-26T10:26:42Z)
• IMMACULATE: A Practical LLM Auditing Framework via Verifiable Computation [49.796717294455796]
  We present IMMACULATE, a practical auditing framework that detects economically motivated deviations.<n>IMMACULATE selectively audits a small fraction of requests using verifiable computation, achieving strong detection guarantees while amortizing cryptographic overhead.
  arXiv  Detail & Related papers  (2026-02-26T07:21:02Z)
• A Framework for Testing and Adapting REST APIs as LLM Tools [11.757827071584737]
  Large Language Models (LLMs) are increasingly used to build autonomous agents that perform complex tasks with external tools.<n>Current benchmarks overlook these challenges, leaving a gap in assessing API readiness for agent-driven automation.<n>We present a testing framework that systematically evaluates enterprise APIs when wrapped as Python tools for LLM-based agents.
  arXiv  Detail & Related papers  (2025-04-22T02:52:08Z)
• Test Amplification for REST APIs via Single and Multi-Agent LLM Systems [1.6499388997661122]
  We investigate the use of large language model (LLM) systems, both single-agent and multi-agent setups, for amplifying existing REST API test suites.<n>We present a comparative evaluation of the two approaches across several dimensions, including test coverage, bug detection effectiveness, and practical considerations such as computational cost and energy usage.
  arXiv  Detail & Related papers  (2025-04-10T20:19:50Z)
• Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs [71.7892165868749]
  Commercial Large Language Model (LLM) APIs create a fundamental trust problem.<n>Users pay for specific models but have no guarantee that providers deliver them faithfully.<n>We formalize this model substitution problem and evaluate detection methods under realistic adversarial conditions.<n>We propose and evaluate the use of Trusted Execution Environments (TEEs) as one practical and robust solution.
  arXiv  Detail & Related papers  (2025-04-07T03:57:41Z)
• Shh, don't say that! Domain Certification in LLMs [124.61851324874627]
  Large language models (LLMs) are often deployed to perform constrained tasks, with narrow domains.<n>We introduce domain certification; a guarantee that accurately characterizes the out-of-domain behavior of language models.<n>We then propose a simple yet effective approach, which we call VALID that provides adversarial bounds as a certificate.
  arXiv  Detail & Related papers  (2025-02-26T17:13:19Z)
• COTS: Connected OpenAPI Test Synthesis for RESTful Applications [0.0]
  We introduce a (i) domain-specific language for OpenAPI specifications and (ii) a tool to support our methodology. Our tool, dubbed COTS, generates (randomised) model-based test executions and reports software defects.
  arXiv  Detail & Related papers  (2024-04-30T15:12:31Z)
• Factcheck-Bench: Fine-Grained Evaluation Benchmark for Automatic Fact-checkers [121.53749383203792]
  We present a holistic end-to-end solution for annotating the factuality of large language models (LLMs)-generated responses. We construct an open-domain document-level factuality benchmark in three-level granularity: claim, sentence and document. Preliminary experiments show that FacTool, FactScore and Perplexity are struggling to identify false claims.
  arXiv  Detail & Related papers  (2023-11-15T14:41:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.