Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions

• URL: http://arxiv.org/abs/2606.04193v1
• Date: Tue, 02 Jun 2026 20:21:58 GMT
• Title: Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions
• Abstract summary: Current AI agent observability is structurally compromised.<n>A compromised or buggy agent can omit, alter, or fabricate its own traces.<n>We propose a class of protocols that resolves this by inverting the trust boundary.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Current AI agent observability is structurally compromised: the entity producing the activity log is the same entity whose activity is being logged. A compromised or buggy agent can omit, alter, or fabricate its own traces, and the operator running the agent has no independent way to detect tampering. We propose a class of protocols that resolves this by inverting the trust boundary: the service that receives an agent's call signs a receipt of what it observed using its own key, encrypts the receipt to the agent's owner, and publishes it to a public transparency log. The owner reconstructs a tamper-evident trail without trusting the agent or its operator. We instantiate the class as Sello, a protocol combining four properties absent in any current system: (P1) receiver-side signing, (P2) HPKE encryption to an owner public key bound to the authorization token via JWS, (P3) publication to a witness-cosigned Merkle log, and (P4) owner-side discovery by token reference. We describe the protocol, analyze its security under an adversary that controls the agent and its operator, present microbenchmarks of the cryptographic operations, and situate Sello among adjacent receipt-protocol work (Signet, AgentROA, Agent Passport System, draft-farley-acta, SCITT). We discuss known limitations including the suppression attack, service collusion, and the adoption-incentive problem.

Related papers

• InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents [13.055427740541793]
  We present InterSAGE, a trust-native protocol suite that supplies this missing security substrate alongside, rather than in place of, communication protocols.<n>InterSAGE comprises four layers: Persistent Identity, Discovery, Trust Negotiation, and Accountability.<n>We show that no prior architecture jointly enforces persistent identity, capability-aware discovery, trust negotiation, and accountability as a unified four-layer trust substrate for secure agent interoperability.
  arXiv  Detail & Related papers  (2026-08-13T10:00:13Z)
• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions [47.65093774088672]
  This survey and tutorial article reviews the literature over the period 1980--2026 on the evolution from classical multi-agent systems to open agent networks.<n>We first review this evolution and show how the trust boundary expands from individual execution to cross-agent, cross-platform, and cross-organizational interaction.<n>We develop a five-dimensional taxonomy covering entity and capability trust, authorization and delegation trust, information and trust, coordination and group-robustness trust, and accountability and settlement trust.
  arXiv  Detail & Related papers  (2026-08-05T09:32:35Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• OpenAgenet/OAN: Technical Architecture for Trust-Governed Agent Identity and Discovery [0.0]
  This paper describes the technical architecture of OpenAgenet / OAN.<n>OAN is a protocol-neutral trust layer for open Agent interconnection.
  arXiv  Detail & Related papers  (2026-06-02T05:18:14Z)
• OpenAgenet/OAN: Open Infrastructure for Trusted Agent Interconnection [0.0]
  OpenAgenet, abbreviated as OAN, is an open infrastructure project for trusted interconnection Agent.<n>It addresses a problem that becomes visible when Agents move from isolated applications into open, multi-operator networks.<n>OAN is designed as a protocol-neutral trust layer.
  arXiv  Detail & Related papers  (2026-06-02T05:14:34Z)
• Who Owns This Agent? Tracing AI Agents Back to Their Owners [7.444382451377645]
  AI agents are increasingly deployed to act autonomously in the world.<n>There is still no reliable way to trace a harmful agent back to the account that deployed it.<n>This is the first work to define the problem and present a practical solution.
  arXiv  Detail & Related papers  (2026-05-15T15:10:33Z)
• OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage [59.3826294523924]
  We investigate the security vulnerabilities of a popular multi-agent pattern known as the orchestrator setup.<n>We report the susceptibility of frontier models to different categories of attacks, finding that both reasoning and non-reasoning models are vulnerable.
  arXiv  Detail & Related papers  (2026-02-13T21:32:32Z)
• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution [49.689452243966315]
  AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks.<n>We propose CausalArmor, a selective defense framework that computes lightweight, leave-one-out attributions at privileged decision points.<n> Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses.
  arXiv  Detail & Related papers  (2026-02-08T11:34:08Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain [82.98626829232899]
  Fine-tuning AI agents on data from their own interactions introduces a critical security vulnerability within the AI supply chain.<n>We show that adversaries can easily poison the data collection pipeline to embed hard-to-detect backdoors.
  arXiv  Detail & Related papers  (2025-10-03T12:47:21Z)
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents [0.6747475365990533]
  In agentic settings reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.<n>We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent.<n>A-JWT carries an agent's identity as a one-way hash derived from its prompt, tools and configuration.
  arXiv  Detail & Related papers  (2025-09-16T23:43:24Z)
• CoTGuard: Using Chain-of-Thought Triggering for Copyright Protection in Multi-Agent LLM Systems [55.57181090183713]
  We introduce CoTGuard, a novel framework for copyright protection that leverages trigger-based detection within Chain-of-Thought reasoning.<n>Specifically, we can activate specific CoT segments and monitor intermediate reasoning steps for unauthorized content reproduction by embedding specific trigger queries into agent prompts.<n>This approach enables fine-grained, interpretable detection of copyright violations in collaborative agent scenarios.
  arXiv  Detail & Related papers  (2025-05-26T01:42:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.