Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering

• URL: http://arxiv.org/abs/2604.11430v1
• Date: Mon, 13 Apr 2026 13:17:12 GMT
• Title: Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering
• Abstract summary: We present presidio-hardened-x402, the first open-source that intercepts x402 payment requests before transmission to detect and redact personally identifiable information (PII)<n>To evaluate the PII filter, we construct a labeled synthetic corpus of 2,000 x402 metadata tripleconfigurations spanning seven use-case categories, and run a 42-precision/recall sweep across two detection modes (regex, NLP) and five confidence thresholds.<n>The recommended configuration achieves micro-F1 = 0.894 with precision 0.972, at a p99 latency of 5.73ms - well within the 50ms overhead budget.
• Score: 0.913755431537592
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: AI agents that pay for resources via the x402 protocol embed payment metadata - resource URLs, descriptions, and reason strings - in every HTTP payment request. This metadata is transmitted to the payment server and to the centralised facilitator API before any on-chain settlement occurs; neither party is typically bound by a data processing agreement. We present presidio-hardened-x402, the first open-source middleware that intercepts x402 payment requests before transmission to detect and redact personally identifiable information (PII), enforce declarative spending policies, and block duplicate replay attempts. To evaluate the PII filter, we construct a labeled synthetic corpus of 2,000 x402 metadata triples spanning seven use-case categories, and run a 42-configuration precision/recall sweep across two detection modes (regex, NLP) and five confidence thresholds. The recommended configuration (mode=nlp, min_score=0.4, all entity types) achieves micro-F1 = 0.894 with precision 0.972, at a p99 latency of 5.73ms - well within the 50ms overhead budget. The middleware, corpus, and all experiment code are publicly available at https://github.com/presidio-v/presidio-hardened-x402.

Related papers

• AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes [38.37599802008238]
  Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped.<n>All existing audits decide backbone identity from the text-output channel.<n>We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs.
  arXiv  Detail & Related papers  (2026-08-30T08:22:12Z)
• The Recall Trap: A Recall-Maximizing Retriever Configuration Reduces Issue Resolution in Fixed-Budget Code Context [45.88028371034407]
  We report a controlled case study in code repair, not a new phenomenon.<n>We toggle one flag (one-chunk-perfile deduplication) on an otherwise identical stack.<n>We map where it holds: it reverses on a lexical BM25 (3.2pp, significant cross-paradigm interaction)<n>We show that at a tight fixed budget, do not hard-deduplicate by file, and A/B packing policies against the task, not the metric flag was tuned.
  arXiv  Detail & Related papers  (2026-08-14T19:22:50Z)
• When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments [53.795332613020946]
  x402 is an emerging payment protocol for Web APIs and autonomous AI agents.<n>We present the first systematic study of authorization correctness and execution safety in current facilitator-mediated x402 deployments in the wild.<n>We derive four new attack vectors, including Free Shopping, Asset Theft, Service Denial, and Gas Abuse.
  arXiv  Detail & Related papers  (2026-07-21T19:45:13Z)
• Equal Accuracy, Unequal Evidence: Search APIs as Decision Surfaces for Tool-Using Agents [0.0]
  We argue that a commercial search API is better understood as a decision surface.<n>We test this claim with one frozen GPT-5.4 agent, two tools (search_web and fetch_page), and 100 questions from SEALQA-HARD.<n>A Kimi-K2.6 oracle labels every content element visible to the agent (URL, title, snippet, and fetched page, when fetched), producing 6,869 valid per-URL judgments.
  arXiv  Detail & Related papers  (2026-07-11T08:22:35Z)
• Five Attacks on x402 Agentic Payment Protocol [4.93108576295077]
  We analyze x402 and empirically show that it is vulnerable in both design and implementation.<n>We present five concrete attacks that reveal weaknesses in authorization, binding, replay protection, and web-layer handling.<n>Our results show that all five attacks are practical and can cause either unpaid service or paid-but-denied outcomes.
  arXiv  Detail & Related papers  (2026-05-12T08:49:10Z)
• How Far Is Document Parsing from Solved? PureDocBench: A Source-TraceableBenchmark across Clean, Degraded, and Real-World Settings [56.70440596502351]
  The past year has seen over 20 open document parsing models, yet benchmarks almost exclusively on OmniDocBench.<n>We present PureDocBench, a benchmark thatrenders document images from HTML/CSS, covering 10 domains, 66 pages, and 1,475 pages.
  arXiv  Detail & Related papers  (2026-05-08T09:30:31Z)
• PolicyGapper: Automated Detection of Inconsistencies Between Google Play Data Safety Sections and Privacy Policies Using LLMs [2.854451361373021]
  In 2022, Google mandated the Data Safety Section (DSS) on Google Play, requiring developers to summarize their data practices.<n>Prior studies indicate that nearly 80% of popular apps contain incomplete or misleading DSS declarations.<n>We present PolicyGapper, an LLM-based methodology for automatically detecting discrepancies between DSS disclosures and privacy policies.
  arXiv  Detail & Related papers  (2026-04-17T15:02:01Z)
• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain [6.142057368768942]
  Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests.<n>We present the first systematic study of this attack surface.
  arXiv  Detail & Related papers  (2026-04-09T16:06:41Z)
• APEX: Agent Payment Execution with Policy for Autonomous Agent API Access [0.0]
  APEX is a complete research system that adapts 402-style payment gating to UPI-like fiat.<n>It preserves policy-governed spend control, tokenized access verification, and replay resistance.<n>Results show that policy enforcement reduces total spending by 27.3% while maintaining 52.8% success rate for legitimate requests.
  arXiv  Detail & Related papers  (2026-04-02T13:32:01Z)
• A402: Bridging Web 3.0 Payments and Web 2.0 Services with Atomic Service Channels [14.234772345560645]
  We present A402, a trust-minimized payment architecture that securely binds Web 3.0 payments to Web 2.0 services.<n>A402 incorporates a TEE-based Liquidity Vault that privately manages the lifecycle of ASCs and aggregates their settlements into a single on-chain transaction.<n>Our results show that A402 delivers orders-of-magnitude performance and on-chain cost improvements over x402 while providing trust-minimized security guarantees.
  arXiv  Detail & Related papers  (2026-03-01T16:45:22Z)
• CRED-1: An Open Multi-Signal Domain Credibility Dataset for Automated Pre-Bunking of Online Misinformation [47.03825808787752]
  CRED-1 is an open, reproducible domain-level credibility dataset.<n>The dataset covers 2,672 domains categorized as fake, unreliable, mixed, conspiracy, or satire.<n>CRED-1 is designed for on-device deployment in privacy-preserving browser extensions.
  arXiv  Detail & Related papers  (2026-02-25T11:45:37Z)
• DeepXiv-SDK: An Agentic Data Interface for Scientific Literature [60.19264121557117]
  DeepXiv-SDK is a three-layer agentic data interface for scientific literature.<n>DeepXiv-SDK supports the complete ArXiv corpus, and is synchronized daily to incorporate new releases.
  arXiv  Detail & Related papers  (2026-02-14T23:07:28Z)
• Sybil-Resistant Service Discovery for Agent Economies [0.0]
  x402 enables Hypertext Transfer Protocol services like application programming interfaces (APIs), data feeds, and inference providers to accept cryptocurrency payments for access.<n>We introduce TraceRank, a reputation-weighted ranking algorithm where payment transactions serve as endorsements.<n>We argue that reputation propagation resists Sybil attacks by making spam services with many low-reputation payers rank below legitimate services with few high-reputation payers.
  arXiv  Detail & Related papers  (2025-10-31T15:29:31Z)
• Enterprise Deep Research: Steerable Multi-Agent Deep Research for Enterprise Analytics [75.4712507893024]
  Enterprise Deep Research (EDR) is a multi-agent system that integrates a Master Planning Agent for adaptive query decomposition.<n>Four specialized search agents (General, Academic, GitHub, LinkedIn) and a visualization agent for data-driven insights are also included.<n>EDR reflects research direction with optional human-in-the-loop steering guidance.
  arXiv  Detail & Related papers  (2025-10-20T17:55:11Z)
• Conformal Prediction for Privacy-Preserving Machine Learning [83.88591755871734]
  Using AES-encrypted variants of the MNIST dataset, we demonstrate that Conformal Prediction methods remain effective even when applied directly in the encrypted domain.<n>Our work sets a foundation for principled uncertainty quantification in secure, privacy-aware learning systems.
  arXiv  Detail & Related papers  (2025-07-13T15:29:14Z)
• BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems [62.17474934536671]
  We introduce the first framework to capture offensive and defensive cyber-capabilities in evolving real-world systems.<n>To capture the vulnerability lifecycle, we define three task types: Detect (detecting a new vulnerability), Exploit (exploiting a specific vulnerability), and Patch (patching a specific vulnerability)<n>We evaluate 8 agents: Claude Code, OpenAI Codex CLI with o3-high and o4-mini, and custom agents with o3-high, GPT-4.1, Gemini 2.5 Pro Preview, Claude 3.7 Sonnet Thinking, and DeepSeek-R1.
  arXiv  Detail & Related papers  (2025-05-21T07:44:52Z)
• Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs [71.7892165868749]
  Commercial Large Language Model (LLM) APIs create a fundamental trust problem.<n>Users pay for specific models but have no guarantee that providers deliver them faithfully.<n>We formalize this model substitution problem and evaluate detection methods under realistic adversarial conditions.<n>We propose and evaluate the use of Trusted Execution Environments (TEEs) as one practical and robust solution.
  arXiv  Detail & Related papers  (2025-04-07T03:57:41Z)
• Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reduction [2.8161155726745237]
  This paper explores the use of large multimodal agents, specifically Gemini 1.5 Flash and GPT-4o mini, to analyze both URLs and webpage screenshots via APIs.<n>We propose a two-tiered agentic approach: one agent assesses the URL, and if inconclusive, a second agent evaluates both the URL and the screenshot.<n>Cost analysis shows that with the agentic approach, GPT-4o mini can process about 4.2 times as many websites per $100 compared to the multimodal approach.
  arXiv  Detail & Related papers  (2024-12-03T09:13:52Z)
• PSTR: End-to-End One-Step Person Search With Transformers [140.32813648935752]
  We propose a one-step transformer-based person search framework, PSTR. PSS module contains a detection encoder-decoder for person detection along with a discriminative re-id decoder for person re-id. On the challenging PRW benchmark, PSTR achieves a mean average precision (mAP) score of 56.5%.
  arXiv  Detail & Related papers  (2022-04-07T10:22:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.