AgenTEE: Confidential LLM Agent Execution on Edge Devices

• URL: http://arxiv.org/abs/2604.18231v1
• Date: Mon, 20 Apr 2026 13:13:31 GMT
• Title: AgenTEE: Confidential LLM Agent Execution on Edge Devices
• Abstract summary: AgenTEE is a system for deploying confidential agent pipelines on edge devices.<n>It enforces strong system-level isolation of sensitive assets and runtime state.<n>Our evaluation shows that such multi-cVMs system is practical, achieving near-native performance with less than 5.15% runtime overhead.
• Score: 4.9434226170553535
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large Language Model (LLM) agents provide powerful automation capabilities, but they also create a substantially broader attack surface than traditional applications due to their tight integration with non-deterministic models and third-party services. While current deployments primarily rely on cloud-hosted services, emerging designs increasingly execute agents directly on edge devices to reduce latency and enhance user privacy. However, securely hosting such complex agent pipelines on edge devices remains challenging. These deployments must protect proprietary assets (e.g., system prompts and model weights) and sensitive runtime state on heterogeneous platforms that are vulnerable to software attacks and potentially controlled by malicious users. To address these challenges, we present AgenTEE, a system for deploying confidential agent pipelines on edge devices. AgenTEE places the agent runtime, inference engine, and third-party applications into independently attested confidential virtual machines (cVMs) and mediates their interaction through explicit, verifiable communication channels. Built on Arm Confidential Compute Architecture (CCA), a recent extension to Arm platforms, AgenTEE enforces strong system-level isolation of sensitive assets and runtime state. Our evaluation shows that such multi-cVMs system is practical, achieving near-native performance with less than 5.15% runtime overhead compared to commodity OS multi-process deployments.

Related papers

• D-MUTRA: DLT-based MUTual Remote Attestation for Multi-Agent Systems [0.5262506959175032]
  This paper presents D-MUTRA, a blockchain-based framework that introduces a mutual RA protocol in multi-agent systems.<n>Agents measure their integrity while verifying that of their peers, acting as both prover and verifier.<n>Results show that D-MUTRA enables agents to continuously attest one another, detects malicious software modifications, and scales to large deployments with negligible overhead.
  arXiv  Detail & Related papers  (2026-08-03T09:10:31Z)
• Toward a Modular Architecture for Embedded AI Agent Systems at the Edge [0.0]
  This paper proposes a modular reference architecture for embedded agent systems.<n>We introduce a tiered design that decouples On-Device Agents and Cloud-Augmented Agents.<n>A key contribution is the integration of a cross-cutting Governance Layer.
  arXiv  Detail & Related papers  (2026-06-01T20:24:18Z)
• DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents [121.77550256034]
  DecodingTrust-Agent Platform (DTap) is a controllable and interactive red-teaming platform for AI agents.<n>DTap-Red is the first autonomous red-teaming agent that explores diverse injection vectors and autonomously discovers effective attack strategies.<n>Through DTap, we conduct large-scale evaluations of popular AI agents built on various backbone models.
  arXiv  Detail & Related papers  (2026-05-06T11:59:48Z)
• When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI [6.1511441479993225]
  Agentic AI systems that plan, invoke tools, maintain persistent memory, and delegate tasks to peer agents introduce a threat surface that differs materially from standalone model inference.<n> Confidential computing offers a hardware-rooted alternative: Trusted Execution Environments (TEEs) isolate agent code and data from privileged system software.<n>This survey synthesizes the design space in four parts: (i) a unified taxonomy of six TEE platforms covering deployment roles and performance tradeoffs; (ii) an agent-centric threat model spanning perception, planning, memory, action, and coordination layers mapped to nine security goals; (iii) a comparative survey of CC
  arXiv  Detail & Related papers  (2026-05-04T23:09:16Z)
• Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs [65.6660735371212]
  We present textbftextscJustAsk, a framework that autonomously discovers effective extraction strategies through interaction alone.<n>It formulates extraction as an online exploration problem, using Upper Confidence Bound--based strategy selection and a hierarchical skill space spanning atomic probes and high-level orchestration.<n>Our results expose system prompts as a critical yet largely unprotected attack surface in modern agent systems.
  arXiv  Detail & Related papers  (2026-01-29T03:53:25Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• Trusted AI Agents in the Cloud [4.2366483628004366]
  Omega is a system that enables trusted AI agents by enforcing end-to-end isolation.<n>It provides efficient multi-agent orchestration with cross-principal trust establishment.<n>It achieves high performance while enabling high-density, policy-compliant multi-agent deployments at cloud scale.
  arXiv  Detail & Related papers  (2025-12-05T18:48:53Z)
• AgentBay: A Hybrid Interaction Sandbox for Seamless Human-AI Intervention in Agentic Systems [29.451397580654316]
  We present AgentBay, a novel service designed from ground up for hybrid interaction.<n>AgentBay provides secure, isolated execution environments Windows, Linux, Android, Web Browsers, and interpreters.<n>Our evaluation demonstrates strong results in security, performance, and task completion rates.
  arXiv  Detail & Related papers  (2025-12-04T01:31:00Z)
• Profile-Aware Maneuvering: A Dynamic Multi-Agent System for Robust GAIA Problem Solving by AWorld [20.01452161733642]
  We propose a dynamic Multi-Agent System (MAS) in our AWorld framework.<n>An Execution Agent is supervised by a Guard Agent that provides on-demand dynamic maneuvering.<n>Our system achieves first place among open-source projects on the prestigious GAIA leaderboard.
  arXiv  Detail & Related papers  (2025-08-13T15:46:25Z)
• Internet of Agents: Weaving a Web of Heterogeneous Agents for Collaborative Intelligence [79.5316642687565]
  Existing multi-agent frameworks often struggle with integrating diverse capable third-party agents. We propose the Internet of Agents (IoA), a novel framework that addresses these limitations. IoA introduces an agent integration protocol, an instant-messaging-like architecture design, and dynamic mechanisms for agent teaming and conversation flow control.
  arXiv  Detail & Related papers  (2024-07-09T17:33:24Z)
• AgentScope: A Flexible yet Robust Multi-Agent Platform [66.64116117163755]
  AgentScope is a developer-centric multi-agent platform with message exchange as its core communication mechanism. The abundant syntactic tools, built-in agents and service functions, user-friendly interfaces for application demonstration and utility monitor, zero-code programming workstation, and automatic prompt tuning mechanism significantly lower the barriers to both development and deployment.
  arXiv  Detail & Related papers  (2024-02-21T04:11:28Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.