Technical Summary: When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI

1. Problem Statement

The deployment of Large Language Model (LLM) driven agents introduces a threat surface distinct from standalone model inference. Unlike stateless query-response systems, agentic AI systems autonomously plan, invoke external tools, maintain persistent memory, and coordinate with peer agents via protocols like Model Context Protocol (MCP) and Agent-to-Agent (A2A). This expanded operational scope creates vulnerabilities that software-layer defenses (e.g., prompt guards, output classifiers) cannot fully address, particularly against privileged infrastructure adversaries (e.g., compromised cloud operators or hypervisors) who can inspect model weights, exfiltrate conversation history, or manipulate tool outputs in transit.

While cryptographic approaches like Fully Homomorphic Encryption (FHE) offer rigorous guarantees, their computational overhead renders them impractical for interactive, billion-parameter workloads. The paper identifies a critical gap: existing surveys address agentic security or confidential computing (CC) for standalone inference separately, but lack a sustained focus on how hardware-rooted trust (Trusted Execution Environments, or TEEs) applies to the full, multi-step agentic stack. Specifically, agentic systems require protections for tool-call isolation, persistent memory confidentiality, and inter-agent message provenance that extend beyond single-call inference.

2. Methodology

The paper employs a structured survey methodology to synthesize the design space of Confidential Computing for Agentic AI.

• Corpus Construction: The literature was assembled via seed sets from confidential LLM inference and agent-security studies, expanded through backward/forward snowballing, and targeted keyword searches (e.g., TEE, enclave, attestation, MCP, A2A).
• Classification Protocol: Retained core papers were coded by TEE substrate, operational class (standalone inference, tool-using single agents, workflow agents, multi-agent systems), protected agent layers, adversary class, and security goals. Systems were labeled "directly agentic" only if they protected tool use, workflow execution, persistent memory, or inter-agent coordination.
• Analytical Lens: The analysis is organized across three dimensions:
  1. Functional Agent Layers: Perception, Planning, Memory, Action, and Coordination.
  2. Adversary Privilege: Ranging from external attackers (A1) to compromised co-tenants (A2), malicious infrastructure operators (A3), and compromised peer agents (A4).
  3. Deployment Boundaries: Process enclaves, Confidential VMs (CVMs), secure-world/realm isolation, and CPU-to-GPU confidential execution.

3. Key Contributions

A. Unified TEE Platform Taxonomy

The paper presents a comparative taxonomy of six TEE platforms relevant to agentic deployments: Intel SGX, Intel TDX, AMD SEV-SNP, ARM TrustZone, ARM CCA, and NVIDIA H100 CC. The analysis evaluates them across six axes:

• Isolation Granularity: Process-level (SGX) vs. VM-level (TDX, SEV-SNP) vs. Realm-level (CCA).
• TCB Size: The size of the Trusted Computing Base.
• Accelerator Confidentiality: Whether the platform extends trust into GPU memory (e.g., NVIDIA H100 CC) or remains CPU-centric.
• Edge Deployability: Suitability for mobile/edge vs. cloud datacenters.
• Inter-enclave Communication Cost: Overhead for communication between isolated components.
• Attestation Model: Mechanisms for remote verification.

B. Agent-Centric Threat Model

The authors formalize a five-layer threat model mapping adversarial capabilities to specific security goals:

1. Perception: Ingestion of user prompts and retrieved documents.
2. Planning/Reasoning: LLM core processing and tool selection.
3. Memory: Short-term context, long-term vector stores, and KV caches.
4. Action/Tool Execution: Invocation of external APIs and real-world tools.
5. Coordination: Inter-agent delegation and communication.

This model maps to nine security goals: input confidentiality, model confidentiality, execution integrity, memory confidentiality, tool-call integrity, message authenticity, provenance, freshness, and side-channel resistance.

C. Comparative Survey of CC Defenses

The survey analyzes representative systems (e.g., TEESlice, CMIF, TEECHAT, Omega, AttestMCP, CAEC, BlockA2A) against the threat model. Key findings include:

• Inference vs. Agentic: Most current evidence supports input and model confidentiality for standalone inference (Perception/Planning layers).
• Gaps: Protection for persistent memory, tool-call integrity, and multi-agent coordination remains partial.
• Directly Agentic Systems: Systems like Omega (SEV-SNP + NVIDIA H100 CC) demonstrate end-to-end confidential runtimes with attestation-gated tool access, while CAEC (ARM CCA) enables confidential shared memory for multi-agent cooperation.

D. Open Research Challenges

The paper synthesizes six critical open challenges:

1. Compound Attestation: Establishing transitive trust across multi-hop agent chains (User → Orchestrator → Specialist → Tool).
2. TEE-Backed RAG: Creating attested vector stores where retrieval operations are gated by attestation.
3. CC-Aware Protocols: Redesigning MCP and A2A to natively support attestation, provenance, and freshness.
4. Side-Channel Leakage: Addressing microarchitectural leaks specific to autoregressive inference patterns (e.g., KV-cache access).
5. GPU-TEE Performance: Characterizing overheads at LLM scale (405B+ parameters) and under concurrent multi-agent workloads.
6. Regulatory Alignment: Bridging the gap between technical attestation evidence and compliance requirements (e.g., EU AI Act, DORA).

4. Results and Findings

• Hardware Maturity: Hardware trust primitives (SGX, TDX, SEV-SNP, CCA, H100 CC) are mature enough for targeted deployments, but no single platform dominates the agentic design space.
• Selective Protection: Practical designs align the trust boundary with the highest-value layer (e.g., protecting system prompts and credentials) rather than attempting to enclose the entire agent stack, which is often infeasible due to memory and I/O constraints.
• Limitations of CC:
  • CC protects data in use from privileged infrastructure operators but does not prevent semantic prompt injection (A1) or ensure the truthfulness of external inputs.
  • Attestation establishes what code is running, not whether the code's goals are aligned with human intent.
  • Side-channel attacks (timing, cache, bus contention) remain a significant risk, particularly for co-tenant adversaries.
  • Availability is not guaranteed; TEEs introduce new operational fragilities (e.g., memory capacity limits, attestation service dependencies).
• Platform Specifics:
  • Intel SGX: Best for fine-grained isolation of sensitive components but limited by EPC capacity and lack of native GPU trust extension.
  • Intel TDX/AMD SEV-SNP: Suitable for cloud-scale "lift-and-shift" of agent services but face challenges with confidential shared memory across VMs.
  • ARM CCA: Promising for multi-realm coordination and edge/cloud hybrid deployments but relies on newer research prototypes.
  • NVIDIA H100 CC: Critical for large-model inference confidentiality but requires a trusted CPU-side root (e.g., TDX) for end-to-end system integrity.

5. Significance and Claims

The paper claims that Confidential Computing offers a necessary, hardware-rooted defense substrate for Agentic AI against privileged infrastructure adversaries, filling a gap left by software-only defenses. However, the authors maintain a modest stance:

• Partial Solution: CC is not a general solution for agent safety, model robustness, or end-to-end system trustworthiness. It addresses specific security goals (confidentiality, integrity of execution) but cannot solve semantic misalignment or input trustworthiness.
• Compositional Future: The path forward lies in compositional advances—combining attested memory services, protocol-native provenance mechanisms, and GPU-aware performance characterization—rather than purely architectural breakthroughs.
• Current State: While several hardware primitives are mature, "no broadly established end-to-end framework yet binds them into a coherent security substrate for production agentic AI." The survey serves to define the design space, highlight the transferability (and lack thereof) from inference-only systems, and frame the specific challenges required to move from pilot deployments to regulated, production-grade agentic systems.