From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents

• URL: http://arxiv.org/abs/2609.05901v1
• Date: Sat, 05 Sep 2026 05:53:51 GMT
• Title: From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents
• Abstract summary: KITA is a review-to-authorization architecture that keeps the user's secret signing key.<n>We implement the complete reviewer-to-executor path with a structured-output LLM adapter.
• Score: 5.02192791020171
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Autonomous LLM agents can turn untrusted content into effectful actions such as payments and permission changes. If the same process interprets this content and controls a reusable signing credential, prompt injection can cross the judgment boundary and reach execution authority. We present KITA, a review-to-authorization architecture that keeps the user's personal secret signing key and every threshold signing-key share outside all LLM processes. Under threshold signature unforgeability and our system assumptions, compromising the proposer and fewer than t reviewer-signer domains cannot produce a valid authorization for a new action without signing contributions from t distinct domains. Thus, any such authorization includes a share from an uncompromised domain, bound to the canonical action and released only after authenticated reviewer approval. This establishes execution-bound authorization integrity. We implement the complete reviewer-to-executor path with a structured-output LLM adapter and threshold BLS. Six system tests validate quorum gating and message binding at this interface, while cryptographic microbenchmarks measure the online signing path and its scaling behavior.

Related papers

• The Native-Signature Boundary in Post-Quantum Distributed Authorization [0.0]
  Post-quantum signature migration poses a distinct systems problem when authorization is distributed among multiple parties.<n>This paper organizes that design boundary through three properties: native-signature compatibility, unilateral-signing resistance, and threshold-layer agility.
  arXiv  Detail & Related papers  (2026-09-03T08:47:05Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Trusted Workflow Relays:Cross-Tenant Email Abuse and Composable Red Team Initial-Access Primitives in Multi-Tenant Clouds [0.0]
  Cloud applications routinely send notifications through provider-operated mail identities.<n>An authenticated actor could reach recipients across tenant boundaries and control content that a trusted provider service delivered.<n>SPF, DKIM, and DMARC can authenticate a message yet cannot establish that an application-level send was authorized.
  arXiv  Detail & Related papers  (2026-08-18T04:31:34Z)
• Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody [0.0]
  We present a dual-gate architecture that separates member authentication from threshold authorization.<n>The architecture can be deployed wherever the asset-control path supports programmable verification.
  arXiv  Detail & Related papers  (2026-07-09T08:20:45Z)
• Sovereign Execution Broker: Enforcing Certificate-Bound Authority in Agentic Control Planes [2.124730017640531]
  Sovereign Execution Broker (SEB) is a runtime enforcement boundary for certificate-bound agentic infrastructure.<n>By separating proposal, admission, and execution, SEB turns certified authority into a short-lived, auditable runtime capability.<n>We present the SEB execution model, certificate and replay-verification predicates, scoped identity semantics, bypass-prevention deployment patterns, failure behavior, and a concrete prototype implementation.
  arXiv  Detail & Related papers  (2026-06-18T17:36:46Z)
• Copyright Detective: A Forensic System to Evidence LLMs Flickering Copyright Leakage Risks [123.36265437655187]
  Copyright Detective is an interactive forensic system for detecting, analyzing, and visualizing potential copyright risks in LLM outputs.<n>It integrates multiple detection paradigms, including content recall testing, paraphrase-level similarity analysis, persuasive probing, and unlearning verification.
  arXiv  Detail & Related papers  (2026-02-05T03:09:52Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents [0.6747475365990533]
  In agentic settings reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.<n>We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent.<n>A-JWT carries an agent's identity as a one-way hash derived from its prompt, tools and configuration.
  arXiv  Detail & Related papers  (2025-09-16T23:43:24Z)
• Shh, don't say that! Domain Certification in LLMs [124.61851324874627]
  Large language models (LLMs) are often deployed to perform constrained tasks, with narrow domains.<n>We introduce domain certification; a guarantee that accurately characterizes the out-of-domain behavior of language models.<n>We then propose a simple yet effective approach, which we call VALID that provides adversarial bounds as a certificate.
  arXiv  Detail & Related papers  (2025-02-26T17:13:19Z)
• Revocable Quantum Digital Signatures [57.25067425963082]
  We define and construct digital signatures with revocable signing keys from the LWE assumption. In this primitive, the signing key is a quantum state which enables a user to sign many messages. Once the key is successfully revoked, we require that the initial recipient of the key loses the ability to sign.
  arXiv  Detail & Related papers  (2023-12-21T04:10:07Z)
• FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature [60.99054146321459]
  Federated learning allows multiple parties to collaborate in learning a global model without revealing private data. We propose a cryptographic signature-based federated learning model ownership verification scheme named FedSOV.
  arXiv  Detail & Related papers  (2023-05-10T12:10:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.