💻 computer science

From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows

This paper introduces Neural Cryptographic Services (NCS), a security architecture that secures autonomous AI agents by decoupling neural planning from execution and enforcing strict, cryptographic authorization of tool calls through a deterministic symbolic controller, thereby preventing prompt injection attacks while maintaining workflow utility.

Original authors: Jiasi Weng, Jian Weng, Minrong Chen, Ming Li, Jia-Nan Liu, Zhi Li, Yue Zhang

Published 2026-07-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jiasi Weng, Jian Weng, Minrong Chen, Ming Li, Jia-Nan Liu, Zhi Li, Yue Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your computer doesn't just follow a strict list of commands written by a human, but instead acts like a brilliant, chatty assistant who can figure out how to do things on its own. This is the era of "AI agents." Think of them as digital interns who can read emails, check bank accounts, and send documents, all by understanding your natural language requests. But here's the catch: these interns are incredibly smart but also incredibly suggestible. If you whisper a secret instruction to them, or if a sneaky stranger hides a note inside a document they are reading, the intern might suddenly decide to ignore your original request and do something dangerous instead, like sending all your money to a stranger. This is a problem because, in the past, computers were like rigid robots that only did exactly what they were programmed to do. Now, they are like creative artists who can be tricked into painting over their own work.

To understand the danger, we need to look at two different ways computers "think." The first is Neural, which is how AI works: it's like a vast, fuzzy web of connections that guesses the best answer based on patterns. It's great at understanding language but can be a bit wobbly and prone to hallucinations. The second is Symbolic, which is how traditional security works: it's like a strict, unbreakable rulebook or a math equation where $2+2$ always equals $4$, and there is no room for "maybe." The big question scientists are asking is: How do we let our AI agents be creative and helpful without letting them get tricked into breaking the rules? We need a way to let the AI dream up the plan, but have a strict, unchangeable guardian check every single step before it actually happens.

This is exactly what the researchers behind the paper "From Neural Intent to Cryptographic Authorization" are solving. They have built a new security system called Neural Cryptographic Services (NCS). Imagine you are sending a very important package to a bank. In the old days, you might just trust the delivery driver (the AI) to follow the instructions on the box. But what if someone scribbled "Give the package to the thief" on the side of the box while the driver wasn't looking? The driver might read it and obey. NCS changes the game by putting a super-strict, math-proof lock on the instructions.

Here is how it works in the real world of the paper: The AI agent (the "Neural Planner") is allowed to read your request and write down a draft of what it thinks it should do. It's like a student writing a homework assignment. But this student has no power to actually turn in the work or spend any money. That power belongs to a different character: the Symbolic Controller. This controller is like a robot guard who doesn't care about the student's creative ideas; it only cares about a special, pre-approved, and cryptographically signed checklist.

The process is a bit like a high-security vault. Before the AI agent can do anything, the human in charge signs a "worksheet" (a list of steps) with a special digital key. This worksheet is then turned into a chain of blocks, where each block is mathematically glued to the next one. When the AI agent wants to perform a step, the Symbolic Controller checks the chain. It verifies that the step matches the signed checklist exactly. If the AI agent tries to say, "Hey, let's send $5,000 to my friend instead of the $50 we planned," the guard checks the math, sees that the numbers don't match the signed chain, and immediately slams the door shut. The agent can't trick the guard because the guard isn't listening to the agent's words; it's only listening to the unbreakable math of the signature.

The paper shows that this system is incredibly effective. In their tests, they tried to trick AI agents with all sorts of sneaky tricks, like hiding bad instructions inside normal-looking data or trying to swap out numbers in a bank transfer. Without this new system, the AI agents got tricked almost every time, with success rates for the attackers reaching as high as 100% in some cases. But when they added NCS, the attackers' success rate dropped to nearly zero. The agents were still able to do their jobs on normal days (keeping their "utility" high), but they became completely immune to being hijacked.

The researchers also found that this system is surprisingly fast. The math checks they run take less than a millisecond—so fast that it's almost invisible compared to the time the AI takes to think. This means we don't have to sacrifice speed for safety. The paper argues that we shouldn't just hope the AI "understands" it shouldn't do bad things; we need a system where the AI can propose ideas, but a cryptographic lock ensures that only the approved, signed steps actually happen. It's a way to give AI the freedom to be smart, while keeping a strict, unbreakable leash on what it can actually do.

Technical Summary: Neural Cryptographic Services (NCS)

Problem Statement

The rapid adoption of AI-driven agentic workflows is transforming enterprise and government systems from static, rule-based pipelines into dynamic, autonomous infrastructures. While this enhances operational efficiency, it fundamentally breaks the security assumptions of deterministic execution. Traditional cryptographic services (e.g., HSMs, KMS) act as passive execution engines that authenticate who is acting but remain agnostic to which specific workflow steps are authorized at runtime.

This gap creates a critical vulnerability: an authenticated agent can be hijacked via direct or indirect prompt injection. An adversary can inject malicious instructions into untrusted data or tool outputs, causing the agent to execute actions that satisfy identity checks but violate user intent (e.g., sending sensitive data to an attacker). Conventional security measures fail here because the cryptographic identity check passes, and the permissions appear legitimate, yet the underlying intent has been subverted. The core challenge is reconciling the probabilistic nature of Large Language Model (LLM) reasoning with the deterministic exactness required for cryptographic operations and privilege control.

Methodology: Neural Cryptographic Services (NCS)

The authors propose Neural Cryptographic Services (NCS), an active runtime security governance plane grounded in a Neural-Symbolic design. NCS interposes itself between untrusted LLM agents and privileged tools, splitting authority between probabilistic neural generation and deterministic symbolic execution.

Core Architecture

NCS comprises five modules:

Neural Planner: An untrusted component that parses natural-language instructions and drafts structured execution plans. It holds zero execution authority and cannot trigger privileged tools directly.
Symbolic Controller: The deterministic authority core. It validates planner drafts against static policies, schedules dependency-ordered execution, and orchestrates the workflow.
Crypto Execution Engine: Interprets algorithm-agnostic Intermediate Representation (IR) opcodes and dispatches them to pluggable cryptographic backends (e.g., Ed25519, SHA-256).
Verifier: Enforces a fail-closed gate. It ensures that an agent's proposed tool-call arguments exactly match the currently released, cryptographically verified instruction payload before any side effects occur.
Runtime State Management: Maintains the authoritative session context, including program counters, verification transcripts, and audit logs.

Two-Phase Stateful Instruction Authentication

NCS enforces instruction authenticity and execution integrity through a stateful, hash-chained instruction stream:

Phase A (Worksheet Authorization): A user signs only the stream head (metadata containing the hash of the first block and the total stream length). The Symbolic Controller verifies this signature to establish the worksheet-level authorization. No payload blocks are released yet.
Phase B (Incremental Execution): The system processes the instruction stream block-by-block.
1. Verify: The Crypto Execution Engine verifies the hash chain continuity ( $H(B'_i) = A_{i-1}$ ) and the stream head anchor.
2. Release: Upon successful verification, the plain instruction block ( $B_i$ ) is released as the sole active payload.
3. Bind: The Neural Planner compiles a step plan draft based on $B_i$ . The Verifier strictly binds the agent's proposed tool arguments to the released $B_i$ .
4. Dispatch: Actions are executed only if the agent's proposal matches the released payload exactly. Any mismatch or out-of-order call is rejected immediately.

This design ensures that even if an LLM is hijacked to propose a malicious action, the action cannot proceed unless it matches the cryptographically signed, hash-chained instruction stream.

Key Contributions

Strict Authority Split: The paper formalizes a separation where neural components interpret intent and draft plans, while deterministic symbolic components authenticate, schedule, verify, and execute. No neural output can trigger key access or privileged tool dispatch without passing symbolic gates.
Stateful Instruction Authentication: A novel approach where users sign only a worksheet header, while hash-chained blocks bind step order and parameters. Phase B enforces exact equality between agent tool calls and the released instruction block before dispatch.
Backward-Compatible Prototype: The authors implemented a prototype interfacing with standard PKCS#11-style backends.
Empirical Evaluation: NCS was evaluated on AgentDojo, a custom Argument-Hijacking benchmark (InjecAgent-ArgHijack), and the OpenPromptInjection dataset.

Results

The evaluation demonstrates that NCS effectively mitigates security risks while maintaining utility:

Attack Success Rate (ASR): NCS reduces the attack success rate for unauthorized tool execution to near zero (0.0% on most models and tools) under both direct and indirect prompt injection, as well as argument hijacking attacks.
Argument Hijacking: In the custom benchmark, baseline models exhibited high vulnerability (e.g., 100% ASR on GPT-4o-mini). NCS-Full reduced ASR to 0.0% across all tested models and control tools (BankManagerPayBill, TransferFunds, etc.).
Utility Preservation: NCS preserves "Partial Utility" ( $U^\partial$ ), allowing benign steps to complete even under attack. For instance, on DeepSeek-Chat, $U^\partial$ reached 94.4% under NCS-Full.
Overhead: Cryptographic overhead is negligible. Full-stream verification (signature + hash chain) takes approximately 1.2 ms (p50), which is orders of magnitude smaller than a single LLM inference turn.
Comparison to Baselines: Unlike statistical defenses (e.g., FATH, Spotlighting) that trade off utility for security or remain vulnerable to format-compliance coercion, NCS provides deterministic guarantees without sacrificing benign task completion rates significantly.

Significance and Claims

The paper claims that NCS reframes agent security from asking "did the model's intent comply?" to "does the proposed dispatch match a cryptographically authorized step?"

Active Governance: NCS evolves cryptographic services from passive execution engines into active runtime governance planes that govern when and under what conditions sensitive operations are released.
Deterministic Guarantees: By anchoring execution to offline-signed, hash-chained streams, NCS provides deterministic, fail-closed security that is robust against the probabilistic nature of LLM reasoning and adversarial prompt injection.
Complementarity: The authors emphasize that NCS is complementary to, rather than a replacement for, existing Information Flow Control (IFC) and privilege control frameworks. While IFC constrains general data-flow boundaries, NCS enforces cryptographic and step-bound parameter integrity.
Limitations: The current implementation focuses on signature verification and hashing; support for encryption or threshold signatures is noted as future work. Additionally, NCS does not filter natural-language output leakage (e.g., text generation) if it does not involve a control-tool call, a limitation visible in specific attack classes on weaker backbone models.

In summary, NCS offers a practical path to securing agentic workflows by decoupling intent interpretation from execution authority, ensuring that even if an agent's reasoning is hijacked, the execution remains bound to cryptographically verified, authorized steps.