KITA：面向 LLM Agent 的密钥隔离门限签名授权架构
From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents
AI 导读
一篇 arXiv 论文提出 KITA，一种让 LLM Agent 的审核真正约束执行的授权架构，将用户签名密钥和所有门限签名密钥份额隔离在 LLM 进程之外。在门限签名不可伪造性假设下，控制提案者和少于 t 个审核签名域的攻击者无法为新动作生成有效授权。作者用结构化输出 LLM 适配器和门限 BLS 实现原型，通过 6 项系统测试、7 个对照场景及密码学微基准验证了法定人数门控与消息绑定。
正文 · 原文
Abstract:Autonomous LLM agents can turn semantic judgments into consequential actions such as payments and permission changes. If the same process makes these judgments and controls a reusable signing credential, a mistaken judgment can reach execution without further approval. To make LLM review govern execution, we present KITA, an authorization architecture that keeps the user's personal signing key and every threshold signing-key share outside all LLM processes. Under threshold-signature unforgeability and our system assumptions, an adversary controlling the proposer and fewer than t reviewer-signer domains cannot produce a valid authorization for a new action without signing contributions from t distinct domains. This execution-bound authorization integrity ensures that each accepted authorization includes a share from an uncompromised domain, bound to the canonical action and released only after authenticated reviewer approval. We implement an in-process prototype of KITA with a structured-output LLM adapter and threshold BLS. Six system tests validate quorum gating and message binding, seven controlled baseline scenarios compare authorization outcomes, and cryptographic microbenchmarks measure online signing cost and its scaling behavior.
| Comments: | 18 pages |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.05901 [cs.CR] |
| (or arXiv:2609.05901v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.05901 arXiv-issued DOI via DataCite |
|
| Journal reference: | NeurIPS Workshop on Beyond Private Training: The New Landscape of AI Privacy (InfPriv 2026), Sydney, Australia |
Submission history
From: Yu Zheng [view email]
[v1]
Sat, 5 Sep 2026 05:53:51 UTC (48 KB)
[v2]
Fri, 23 Oct 2026 00:40:11 UTC (52 KB)
来源：arXiv cs.AI · arxiv.org