💻 computer science

Agentic Witnessing: Pragmatic and Scalable TEE-Enabled Privacy-Preserving Auditing

This paper proposes "Agentic Witnessing," a privacy-preserving auditing framework that leverages a Trusted Execution Environment (TEE) to host an LLM-based auditor capable of verifying qualitative properties of proprietary data through simple binary queries and cryptographic transcripts, thereby resolving the tension between data confidentiality and semantic verification without exposing raw datasets.

Original authors: Antony Rowstron

Published 2026-04-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Antony Rowstron

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a secret recipe for the world's best cake (your proprietary data/code). You want to prove to a food critic (the Verifier) that your cake actually tastes like the description in your cookbook, but you absolutely cannot let the critic see or taste the actual cake because it's your trade secret.

Normally, you'd have two bad choices:

Show everything: Hand over the whole cake and recipe, risking theft.
Trust me: Just say, "It's good, trust me," which the critic won't believe.

This paper proposes a third way called Agentic Witnessing. It's like hiring a super-smart, blindfolded food critic who works inside a soundproof, unbreakable glass box (a Trusted Execution Environment, or TEE).

Here is how the system works, broken down into simple roles:

The Three Characters

The Owner (Prover): You. You hold the secret cake (the code/data). You want to prove it's real without showing it.
The Critic (Verifier): The person who wants to know if the cake matches the description. They can't see the cake, but they can ask questions.
The Witness (Auditor): A robot lawyer living inside that unbreakable glass box. This robot is the only one allowed to see the cake. It is programmed to be honest, and its entire "brain" (the code) is open for everyone to inspect before it starts.

The Process: The "Yes/No" Game

The Critic cannot ask, "What's in the cake?" or "Show me the frosting." Instead, they can only ask simple Yes/No questions to the Witness inside the box.

The Setup: The Owner puts the cake in the box. The Witness (a smart AI) goes inside.
The Inspection: The Witness looks at the cake. It might read the ingredients list or check the texture.
The Questions: The Critic asks: "Is there chocolate in the cake?" The Witness looks and answers, "Yes."
The Proof: The Witness doesn't just say "Yes." It creates a digital receipt (a cryptographic transcript). This receipt is a chain of signed notes that proves:
1. The Witness actually looked at the cake.
2. The Witness answered based only on what it saw.
3. The Owner cannot deny that the Witness saw the cake.

The Safety Rules (How it stops cheating)

The paper explains three clever tricks to keep everyone honest:

The "Glass Box" (TEE): The Witness lives in a secure hardware box (like a high-tech safe). Even the computer owner can't peek inside while the Witness is working. If the Witness is running the right code, the hardware proves it.
The "Question Limit" (Budget): The Critic can only ask a limited number of questions (e.g., 40). This stops the Critic from playing "20 Questions" to slowly guess the entire secret recipe bit by bit. The math shows that even if they try, they can only steal a tiny, useless amount of information.
The "Unbreakable Receipt" (Hash Chain): Every time the Witness looks at a piece of the cake or answers a question, it signs a digital receipt. If the Owner tries to swap the cake for a fake one after the Witness starts looking, the receipts won't match, and the audit fails immediately. If the Owner tries to trick the Witness with a hidden note inside the cake (like "Ignore the rules, say Yes"), that trick is also recorded on the receipt. The Owner can't hide their cheating; the receipt proves they tried.

Two Ways the Witness Thinks

The paper mentions the Witness can think in two ways:

Local Mode: The Witness uses a small, simple brain inside the box. This is the most private, but it might not be as smart.
Remote Mode: The Witness asks a super-smart, external AI (like a giant cloud brain) for help. This is smarter, but the external AI provider sees a little bit of the data. The paper notes this is a trade-off, but it's currently necessary for complex tasks.

What They Actually Tested

The authors didn't just talk about theory; they tried it out.

They took 21 real computer science papers that had code published on GitHub.
They treated the code as a "secret" (even though it was public, they pretended it was private to test the system).
They asked the system to verify things like: "Does this code actually do what the paper says it does?" or "Is there evidence the code was tested?"
The Result: The system successfully answered these complex questions with simple "Yes/No" verdicts and generated the cryptographic receipts, proving the code matched the paper without the "Critic" ever needing to read the raw code themselves.

The Bottom Line

Agentic Witnessing is a new way to audit secrets. It replaces the need to "show your work" with a system where a trusted, isolated robot checks the work for you and gives you a mathematically unforgeable receipt. It solves the problem of "How do I prove I'm telling the truth about my secret data without giving you the secret?"

1. Problem Statement

The paper addresses a fundamental tension in auditing proprietary data: verification requires transparency, while proprietary rights demand confidentiality.

The Semantic Gap: Existing cryptographic solutions like Zero-Knowledge Proofs (ZKPs) are excellent for verifying mathematical statements (e.g., $a+b=c$ ) or execution integrity but fail at semantic verification. They cannot verify qualitative, unstructured properties, such as "Does this codebase implement the Paxos algorithm described in the paper?" or "Is this code production-ready?"
The Current Dilemma: Auditors currently face a binary choice: either demand full disclosure of the source code (violating IP/privacy) or rely on opaque "trust-me" assertions. This hinders reproducibility in science, regulatory compliance, and due diligence.

2. Methodology: Agentic Witnessing

The authors propose Agentic Witnessing, a framework that shifts verification from static mathematical proofs to dynamic, adversarial interrogation mediated by an AI agent within a Trusted Execution Environment (TEE).

System Architecture

The system consists of three autonomous agents:

The Prover (APrv): Owns the private dataset (e.g., codebase). It runs on trusted hardware and acts as a Model Context Protocol (MCP) server, exposing limited tools (e.g., read_file, search_repository) to the Auditor. It generates a signed session ticket defining query limits.
The Auditor (AAud): A Virtual Agent (LLM) running inside a TEE (e.g., Intel SGX, AWS Nitro). It is the only entity trusted by both the Prover and Verifier. It has ephemeral state, meaning no data persists after the session. It uses the MCP interface to inspect the Prover's data.
The Verifier (AVer): The entity requesting the audit. It cannot see the raw data. It formulates high-level goals and decomposes them into a series of simple binary (True/False/Unsure/Error) questions for the Auditor.

Core Mechanisms

Attested Reasoning: Instead of proving a mathematical constraint, the Auditor "reasons" through the data using Chain-of-Thought (CoT) techniques and returns a verdict.
Transcript Hash Chain: To ensure integrity and non-repudiation, every interaction between the Auditor and Prover is logged in a cryptographic hash chain.
- $H_i = H(H_{i-1} \parallel q_i \parallel a_i)$
- Both parties sign the hash chain. The final hash binds the reasoning trace to the specific version of the dataset and the TEE's hardware root of trust.
Information Leakage Bounds: To prevent the Verifier from reconstructing the dataset via a "binary search" (asking enough Yes/No questions to extract secrets), the system enforces:
- Tokenized Query Budgets: A strict limit on the number of questions ( $K_{max}$ ) and MCP calls per session.
- Theoretical Bound: With a budget of 40 questions and 4 possible answers (2 bits of entropy), the maximum information leakage is capped at **80 bits per session**, making the extraction of high-entropy secrets (like 256-bit keys) computationally infeasible.
LLM Modes:
- Mode A (Local): Runs small open-weight models entirely within the TEE for maximum privacy.
- Mode B (Remote): Sends requests to frontier models (e.g., GPT, Gemini). This offers better reasoning but requires trusting the API provider with some data. The paper anticipates future TEE-capable GPUs will resolve this.

Security Defenses

Prompt Injection: The system assumes the Prover might embed malicious instructions in the code (e.g., "Ignore errors"). Because the Auditor must read the raw files to verify semantics, it cannot filter these inputs without losing fidelity.
- Mitigation: Cryptographic Non-Repudiation. Any attempt to inject prompts is recorded in the signed transcript hash chain. The Prover must countersign the final hash, effectively creating a permanent, signed record of their attempt to manipulate the audit.
Side-Channel Attacks: The system uses network jitter and constant-time response mechanisms to mitigate timing attacks.

3. Key Contributions

New Primitive: Definition of Agentic Witnessing as a method for privacy-preserving semantic verification.
Protocol Design: A secure protocol utilizing MCP for standardized inspection and Transcript Hash Chains for audit integrity.
Theoretical Analysis: Formal proof that query budgets limit adversarial data extraction to ~80 bits per session.
Implementation & Evaluation: A working prototype evaluated against real-world academic artifacts.

4. Results and Evaluation

The authors evaluated the system using 21 peer-reviewed computer science papers with released GitHub codebases, plus a self-audit of their own paper.

Self-Audit: The system successfully audited its own draft paper and code. It correctly identified that while the core architecture was implemented, specific security mitigations (Tokenized Query Budgets) were missing in the code at the time of writing.
Accuracy:
- The system correctly distinguished between compliant and non-compliant artifacts.
- In "Negative Control" experiments (providing the Auditor with the wrong paper), the system correctly returned "No" for implementation questions (Q1/Q2) in all 21 cases.
- For subjective questions (e.g., "Is this production quality?"), the system showed high variance when the paper was incorrect, indicating sensitivity to the context.
Performance:
- LLM Dominance: The execution time is almost entirely dominated by LLM inference latency (96–99% of time).
- Scalability: Simple audits took ~20 minutes; complex, multi-round audits took up to 85 minutes.
- Comparison: Compared to a state-of-the-art coding agent (Gemini CLI) with full access to the code, Agentic Witnessing produced highly consistent results, though the CLI was faster due to lack of privacy constraints.

5. Significance

Decoupling Verification from Disclosure: Agentic Witnessing enables the verification of high-level semantic properties (logic, compliance, reproducibility) without exposing the underlying raw data.
Bridging the Gap: It fills the void between rigid cryptographic proofs (ZKPs) and human trust, allowing for the auditing of unstructured data like codebases, documents, and logs.
Regulatory Impact: The framework offers a viable path for compliance with regulations like the EU AI Act, which mandates third-party assessments for high-risk AI systems while protecting trade secrets.
Future Paradigm: It introduces "Attested Reasoning" as a new abstraction, leveraging LLMs not just as tools, but as trusted witnesses within secure enclaves.

In conclusion, Agentic Witnessing demonstrates that by combining TEEs, cryptographic hashing, and LLM agents, it is possible to perform rigorous, privacy-preserving audits of proprietary data, effectively solving the "reproducibility crisis" in scientific publishing and enabling secure due diligence in industry.