Remote Attestation

Follow this topic Ask about this topic

Remote attestation studies how one computer can prove to another which hardware, software, or workload is running, typically using hardware-backed measurements and signed evidence checked by a verifier. Methods include trusted execution environments, layered identity for containers and Kubernetes Pods, and attestations bound to API requests, communication channels, or runtime policies. These techniques are being applied to confidential workloads, AI agents and API routers, and time-critical settings such as robotics and vehicle-to-infrastructure systems. A key open tension is that valid evidence can establish what was measured or executed, but not by itself that the software is safe, its data is trustworthy, or its evidence is fresh enough for the decision at hand.

Latest papers

10 papers1 paper in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Mission-Aware Attestation Envelopes for Time-Critical Autonomous Action: A Hardware-in-the-Loop V2I Study
Oct 6, 2026Dimitrios Nikou, Nikolaos Kekatos, Sophia Petridou +1Remote Attestation Runtime Assurance
International Hellenic University, Greece · Clone Systems, Cyprus · University of Macedonia, Greece
Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics
Sep 8, 2026Leming Shen, Shikai Geng, Yuanqing Zheng +1Cybersecurity Software Security
University College London · The Hong Kong Polytechnic University
Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap
Aug 30, 2026Ashok Subbabhatta GopalakrishnaAgent Communication Protocols MCP Security
independent researcher
The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs
Jun 15, 2026Sipeng Xie, Qianhong Wu, Hengrun Lu +4Remote Attestation LLM Agent Security
1Beihang University · 2Renmin University of China · 3Independent
Implement Kubernetes Pod-Level Remote Attestation for Confidential Workloads on dstack
Jun 2, 2026Yang Yang, Kevin Wang, Yuanhai Luo +4Cybersecurity Remote Attestation
OPPO · Phala
Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels
May 26, 2026Qiancheng Wu, Wenhui Zhang, Gan Fang +5Agent Communication Protocols Software Security
Roblox
When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI
May 4, 2026Javad Forough, Marios Kogias, Hamed HaddadiCybersecurity Remote Attestation
Department of Computing Imperial College London London, United Kingdom
Certified Purity for Cognitive Workflow Executors: From Static Analysis to Cryptographic Attestation
May 1, 2026Alan L. McCannRemote Attestation Formal Verification
Mashin, Inc.
AEX: Non-Intrusive Multi-Hop Attestation and Provenance for LLM APIs
Mar 15, 2026Yongjie GuanRemote Attestation LLM Auditing
Zhejiang University of Technology
Proof-of-Guardrail in AI Agents and What (Not) to Trust from It
Mar 6, 2026Xisen Jin, Michael Duan, Qin Lin +4LLM Guardrails Remote Attestation
Sahara AI · University of Southern California

Oct 6, 2026J/K move · Enter open · S save

Mission-Aware Attestation Envelopes for Time-Critical Autonomous Action: A Hardware-in-the-Loop V2I Study

Dimitrios Nikou, Nikolaos Kekatos, Sophia Petridou, Stylianos Basagiannis

International Hellenic University, Greece · Clone Systems, Cyprus · University of Macedonia, Greece

Remote Attestation Runtime Assurance

Open paper AskPDF arXiv

An autonomous system that asks for a privileged physical action is usually gated on integrity evidence: a platform proves what it is running, and the request is granted or refused on that basis. Such a gate is normally treated as a predicate, yet the evidence behind it has an age, the decision that consumes it has a latency, and the physical system that waits for it has a deadline. We formulate mission-aware attestation as a runtime assurance contract that holds only when integrity is valid, the evidence is fresh enough, and the decision completes inside a budget derived from the current physical state. The contract yields four operational outcomes where a binary gate yields two, separating a refusal caused by tampering from one caused by stale evidence and from one caused by a late decision. We evaluate it on a hardware-in-the-loop vehicle-to-infrastructure platform: a driving simulator supplies the physical state and the authorisation deadline, while a microcontroller on-board unit and a TPM-backed roadside unit running Linux integrity measurement supply the assurance evidence. A security-blind model admits the whole operating space and a hardware-informed one three quarters of it, and every point it refuses fails the freshness margin rather than the response margin. Moving the attestation interval across the range the verifier permits costs about as much as a fivefold scaling of the latency distribution, and the interval is directly configurable, which makes it the immediately actionable deployment parameter. If the freshness bound does not exceed the authorisation budget, every late decision is also stale and lateness becomes unobservable, so the attestation interval and the freshness bound cannot be chosen from security requirements alone.