What question did this study set out to answer?

The primary aim is to develop a secure method for credential mediation that prevents unauthorized access in untrusted environments.

July 9, 2026Mathematics0 citationsOpen Access

View Full Paper

Operator-Blind Secret Mediation for AI Agents: A Formal Model and FHE Construction for Credential Derivation on Untrusted Infrastructure

SJShutong Jin RGRuiyi Guo RCRay C. C. Cheung

Key Points

The primary aim is to develop a secure method for credential mediation that prevents unauthorized access in untrusted environments.
Developed CapSeal, a capability-based broker for managing credentials without direct access.
Designed a split-broker architecture using fully homomorphic encryption to keep secrets secure from operators.
Implemented an end-to-end TFHE-rs prototype to test the proposed architecture and measure its performance.
CapSeal reduces the risk of credential exfiltration by replacing direct access with session-bound handles.
The prototype performance was measured at 9 seconds per request, significantly slower than the plaintext alternative.
Comparison of FHE with TEE and MPC alternatives revealed differences in assurance and performance.

Abstract

Artificial intelligence (AI) agents increasingly need credentials such as application programming interface (API) keys and Secure Shell (SSH) credentials, but placing those secrets in the agent process exposes them to prompt injection, tool misuse, and exfiltration through ordinary agent outputs. We present CapSeal, a capability-based broker that replaces direct secret access with session-bound, non-exportable handles. Agents request policy-evaluated actions, while the broker performs credential-bearing Hypertext Transfer Protocol (HTTP) and SSH execution through typed executors with schema validation, replay protection, revocation epochs, and tamper-evident audit logging. We extend this design to hosted settings where the broker operator is not trusted with tenant secrets. Our main contribution is operator-blind secret mediation: a split-broker architecture in which a small trusted tenant gateway cooperates with an untrusted operator service that stores the master secret only as a fully homomorphic encryption (FHE) ciphertext and evaluates per-request derivations without decrypting it. We formalize the model and prove computational operator blindness from indistinguishability under chosen-plaintext attack (IND-CPA) security of the FHE scheme, together with conditional capability binding for any secure pseudorandom function/message authentication code (PRF/MAC) instantiation. We implement an end-to-end TFHE-rs prototype that exercises split-broker derivation, multi-tenant revocation and rate limiting, audit integration, and HTTP/SSH mediation. The prototype uses a non-cryptographic homomorphic stand-in and measures the cost of crossing the operator-untrusted boundary at about 9 s per request, roughly 17 million times slower than the plaintext path. We also give LowMC and Rasta transciphering designs and compare FHE with trusted execution environment (TEE)- and secure multiparty computation (MPC)-based alternatives, positioning each trust boundary by assurance and performance.

问 AI

Bookmark

View Full Paper

问 AI

Bookmark

View Full Paper

Operator-Blind Secret Mediation for AI Agents: A Formal Model and FHE Construction for Credential Derivation on Untrusted Infrastructure

Key Points

Abstract

Cite This Study

Also Consider

Also Consider