Pith. sign in

REVIEW 2 major objections 4 minor 41 references

Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation

T0 review · 2 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that authorization for an autonomous agent's concrete request can be made a cryptographically verifiable fact, bound to the agent, the request, the execution context, and policy satisfaction, while keeping private attribut

desk verdict The binding-separation framing is worth stealing, but the CVA relation never authenticates private attributes, so the core 'authorization' claim is vacuous as formalized. read the letter →

arxiv 2607.21325 v1 pith:567QVS6S submitted 2026-07-23 cs.CR cs.AI

M. Llambí-Morillas , D. Fernández-Fernández This is my paper · ORCID
classification cs.CRcs.AI MSC 94A60
keywords autonomousAIagentsauthorizationzero-knowledgeproofscryptographicrelationrequestbindingexecutionreplayresistancezk-SNARK
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to prove a hypothesis: an autonomous agent's authorization to perform a concrete action can be represented as a cryptographically verifiable relation, not merely as a consequence of who the agent is or what credential was delegated. The proposed relation R_CVA jointly binds an agent principal, a canonical request, an execution context, a policy version, and a proof of policy satisfaction, with private attributes hidden inside a zero-knowledge witness. The paper formalizes five candidate security properties—authorization soundness, principal binding, request binding, policy binding, and replay resistance—and shows through an executable prototype that principal binding, plan-level request binding, and circuit-encoded policy satisfaction can be instantiated in practice. It also isolates a structural gap that the prototype does not close: a valid authorization proof does not guarantee that the runtime executes the same request (authorization binding ≠ execution binding). A reader should care because this reframes agent security around a per-request cryptographic guarantee rather than static identity and delegation.

What carries the argument

The central object is the CVA relation R_CVA, defined by four simultaneous conditions: BindPrincipal (the identity commitment opens to the agent's secret and randomness), BindRequest (the public request commitment equals a hash of the canonical private request), BindContext (the context commitment equals a hash of private contextual attributes), and SatisfyPolicy (a deterministic policy predicate evaluates to 1 over the witness). This relation is the load-bearing device: each conjunct rules out a distinct transfer attack, and the whole relation is what a zero-knowledge proof attests to. In the prototype the relation is compiled into arithmetic circuit constraints, with freshness and replay p

What would settle it

Run the proof-of-concept with a policy that must consult a changing runtime state (e.g., current resource availability or session context). If the policy cannot be expressed in the circuit without recompiling, the hypothesis fails for that policy class. Alternatively, find two distinct requests that yield the same canonical commitment, which would break BindRequest.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is H1: authorization decisions for autonomous AI agents can be represented as cryptographically verifiable relations that jointly bind an agent principal, a concrete authorization request, an execution context, and satisfaction of an applicable policy, while selectively preserving confidentiality of private attributes. The formalization is the relation R_CVA = BindPrincipal ∧ BindRequest ∧ BindContext ∧ SatisfyPolicy, where each conjunct is a commitment or predicate check over a public statement and a private witness. The proof-of-concept instantiates selected bindings as arithmetic circuit constraints in a zero-knowledge SNARK: the agent's secret

Load-bearing premise

The claim rests on the premise that authorization policies can be encoded as static, deterministic predicates over private attributes; if real-world agent policies require dynamic or procedural evaluation, the CVA relation as defined cannot represent them.

Editorial extensions

If this is right

  • If H1 holds, verifiers can accept an authorization without seeing the agent's private attributes: the proof itself is the authorization evidence, separate from identity evidence and delegation evidence.
  • A proof bound to one principal cannot authorize another principal's request, and a proof bound to one request cannot authorize a different request, because the commitments and the policy predicate are tied together in the public statement.
  • Replay resistance is achievable as a workflow property: bind the nonce and validity time into the public statement, then enforce single-use nonce state at the gateway.
  • The identity/authorization/execution separation means any secure agentic deployment needs an additional runtime trust anchor (execution receipts, attestation, or a trusted environment) to ensure the authorized request is the executed one.
  • Only policies expressible as static, deterministic arithmetic predicates can be represented without circuit recompilation; this bounds the class of policies CVA can cover as currently formulated.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The conjunct structure suggests a composable upgrade path: each binding can be hardened or extended independently—e.g., replacing a deterministic identity hash with a randomized commitment, or adding a delegation-scope conjunct for multi-agent chains—without altering the rest of the relation.
  • If context binding is implemented as specified, an empirical test could determine which contextual attributes actually change policy outcomes, giving a data-driven answer to the paper's RQ1.
  • The plan-level proof model implies a latency trade-off: generating one proof per task plan is cheap on the verification side, but it pushes the system toward trusting the runtime to follow the plan, which is exactly the gap the paper flags.
  • A natural extension would be to couple the authorization proof with a short-lived execution receipt, making execution binding a second cryptographic relation rather than a trust assumption.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes and discusses a preliminary formal abstraction, CVA, for cryptographically verifiable agent authorization. Its central hypothesis H1 is that authorization decisions for autonomous AI agents can be represented as a relation R_CVA that jointly binds an agent principal, a concrete request, an execution context, and policy satisfaction, while hiding private attributes. The paper defines a system model, a public/private statement pair, a four-conjunct relation (Eq. 22), candidate security properties (authorization soundness, principal/request/policy/context binding, replay resistance), and a Groth16 zk-SNARK proof-of-concept that instantiates selected elements of the model. It also identifies the separation between identity binding, authorization-request binding, and runtime execution binding as an open structural problem. The manuscript is explicitly positioned as a hypothesis/preliminary model and is unusually candid about its limitations: unproven reductions, an unaudited circuit, unimplemented context binding, static-policy-only expressiveness, and no multi-agent delegation analysis.

Significance. If the central hypothesis can be made semantically meaningful and supported by formal reductions, the abstraction would provide a useful per-request authorization evidence primitive distinct from identity and delegation, and the paper's explicit separation of authorization-request binding from runtime execution binding is a valuable structural observation. The paper's strengths include an executable, publicly referenced prototype (Section 5.1), a clear mapping of what the prototype does and does not cover (Table 2), and a falsifiable research agenda (Section 6). However, the current relation omits any trusted source for the private attributes and context used in policy evaluation, which as formalized makes the authorization claim vacuous for a prover with a valid key. This gap must be resolved before the abstraction can be considered a meaningful model of authorization. The novelty claim regarding the absence of prior request-bound authorization frameworks is plausible but rests on a selective reading of the related-work table.

major comments (2)
  1. [§3.3, Eqs. (17)–(21); §4.1, Eq. (27)] The witness w in Eq. (17) contains ski, rho, attrsi, qpriv, and cpriv, all supplied by the prover. R_CVA in Eq. (22) constrains attrsi and cpriv only through the predicate Pj(attrsi,qpriv,cpriv)=1 in Eq. (21), with no link to an issuer signature, attribute authority, or other trusted source. SatisfyPolicy is therefore an existential statement over prover-chosen values. For a policy such as Pj := (attrsi.role == 'admin'), any party holding a valid ski—including the 'unauthorized or partially authorized agents' in §3.4—can set attrsi.role='admin' and produce an accepting proof. Authorization soundness in Eq. (27) only guarantees that some witness exists for the statement, not that the prover's true attributes satisfy the policy. A parallel issue applies to cpriv: context binding in Eq. (36) prevents commitment substitution but does not prevent fabrication of false context. This is more fun
  2. [§3.3, Eq. (21); §7, Limitation 4] H1 is stated for 'an applicable policy' without restricting the policy class, but Eq. (21) confines policies to static deterministic arithmetic predicates over fixed inputs. Dynamic or procedural policies—for example, time-of-day restrictions, separation-of-duty histories, rate limits, or policies that depend on external oracle state—cannot be represented without circuit recompilation and therefore do not fall inside the relation as defined. Since Section 7 acknowledges this limitation, the paper should either narrow H1 to a specific policy class or provide at least one nontrivial dynamic policy that can be encoded in the formal model. As it stands, the central claim is only defended for a restricted class that may not cover the realistic agent authorization cases the paper motivates.
minor comments (4)
  1. [§1, §3.1] Typographical issues: in the Introduction, 'satify' should be 'satisfy'; in Eq. (12)'s surrounding text, 'execution concept' should presumably be 'execution context'.
  2. [§2, Table 1] The claim that 'no existing work explicitly models authorization as a request-bound cryptographically verifiable relation' is difficult to falsify as stated, especially because Table 1 marks several related works as 'Partial' on pre-execution authorization. Suggest softening to 'no prior framework formalizes...' or adding a sentence explaining why the partial approaches do not provide request-bound, policy-satisfying cryptographic evidence.
  3. [§5.3, Table 2] The 'Policy binding' row describes the prototype as having 'Fixed circuit/policy relation; no explicit pidj public input', whereas §4.3's formal policy-binding property relies on including pidj in the public statement x. Please clarify whether the prototype is meant to implement the formal property or only a weaker version.
  4. [§6, RQ3] The statement that verification latency is 'effectively constant' and 'very low' is presented as preliminary evidence, but no benchmark data appear in this paper and Limitation 7 states that no comparative benchmark was conducted. This claim should be either removed, supported by data, or explicitly labeled as an observation from the prototype's single configuration.

Circularity Check

0 steps flagged · score 1.0 of 10

Definitional hypothesis paper with transparent self-citation; no circular derivation.

full rationale

Section 3 defines R_CVA (Eqs. 18–22) as the conjunction of commitment-opening constraints and a policy predicate; Section 4 then states candidate security properties whose validity is explicitly delegated to standard assumptions (knowledge-soundness, commitment binding, collision resistance) and to correct circuit encoding, with complete reductions 'left as future work' (Section 7, limitation 1). There is no fitted parameter, no data subset used to predict a closely related quantity, and no uniqueness theorem imported from the authors' prior work. The only self-reference is the authors' own prototype [22], cited in Section 5.1 as 'the experimental precursor from which the present hypothesis emerged'; the paper explicitly disclaims that the prototype is a complete validation and lists unresolved limitations (static policies only, no context binding, no execution binding, no independent audit). Because the prototype is publicly executable and the model does not depend on any unverified self-cited theorem, this is transparency rather than load-bearing circularity. The skeptic's objection that attrsi and cpriv are prover-supplied without certification is a genuine soundness gap in the proposed authorization semantics, but it is a missing trust anchor, not a derivation that reduces to its own inputs; it belongs in a correctness/security review, not in the circularity score.

Assumptions & free parameters 0 free parameters · 5 assumptions · 2 invented entities

The paper introduces no fitted constants or empirical parameters; its contribution is a formal definitional framework plus a simplified implementation. The load-bearing assumptions are standard cryptographic assumptions (collision resistance, commitment binding, SNARK knowledge-soundness, trusted setup) and the modeling assumption that policies are static arithmetic predicates. The two 'invented entities' are conceptual abstractions with no falsifiable handle outside the paper; they earn their place only if the PoC and future proofs instantiate them.

assumptions (5)
  • domain assumption Policies Pj are deterministic predicates over (attrsi, qpriv, cpriv)
    Equation (21); the PoC uses a static arithmetic circuit; dynamic policies are excluded (Section 7, limitation 4).
  • domain assumption Collision resistance of Hq, Hc, HP and binding of CommitID
    Equations (18)-(20) and (31)-(36); reductions to standard assumptions are deferred (Section 4 intro, Section 7 limitation 1).
  • domain assumption Knowledge-soundness and zero-knowledge of the underlying SNARK (Groth16)
    Authorization soundness (Section 4.1) and attribute privacy inherit from these assumptions; no reduction is provided.
  • domain assumption Groth16 trusted setup is trustworthy
    Section 7 limitation 3 explicitly acknowledges the CRS as an external trust assumption.
  • domain assumption Gateway faithfully maintains nonce state and is only partially trusted
    Equations (26), (37)-(40); limitation 9 places gateway compromise outside the threat model.
invented entities (2)
  • Authorization evidence object
    purpose: Cryptographic/procedural artifact proving a request-bound authorization statement (as opposed to identity or audit evidence)
    Conceptual construct introduced in Section 1; it is a framing device, not an independently measurable entity, though the PoC proof is a constructive instance.
  • CVA relation RCVA
    purpose: Formal relation jointly binding principal, request, context, policy satisfaction
    Defined in Section 3.3; it is a definition, and its instantiation is the PoC.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation." pith.science (2026). https://pith.science/paper/567QVS6S

@misc{pith2026260721325,
  author       = {Pith},
  title        = {Pith review of: Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/567QVS6S}},
  note         = {Machine review of arXiv:2607.21325}
}
abstract

Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution.

Figures

Figures reproduced from arXiv: 2607.21325 by the authors.

Figure 1
Figure 1. Proof-of-concept authorization workflow. [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 2 canonical work pages

  1. [1]

    the looming authorization crisis

    Introduction—Autonomous AI agents are no longer passive software clients. They are increasingly designed to invoke tools, call API, access protected re- sources, construct multi-step action sequences, delegate subtasks, and act on external resources with limited human supervision. This transition from determinis- tic client behavior to autonomous, context...

    arXiv 2026

  2. [2]

    Related Work and Positioning—Zero- knowledge proofs have progressively moved from foun- dational interactive protocols [8] to practical non- interactive constructions suitable for real-world deploy- ment. Groth16 [9] established the basis for efficient pairing-based non-interactive arguments; STARKs [10] removedtrusted-setuprequirementsatthecostoflarger p...

  3. [3]

    Preliminary Formal Model— 3.1. System and Request Model.We model an agentic authorization environment as a tuple: S= (A,G,T,R,P),(9) where A is the set of autonomous agents,G the set of authorization gateways or verifiers,T the set of external tools or callable services,R the set of protected resources, andP the set of authorization policies. To refer to ...

  4. [4]

    Candidate Security Properties—The follow- ing properties are intended to address the principal attack vectors identified in the threat model of Subsec- tion 3.4: proof forgery without a valid witness, cross- principal proof transfer, cross-request proof transfer, cross-policy proof transfer, and proof reuse. Com- plete reductions of these properties to st...

  5. [5]

    Proof-of-Concept implementation— 5.1. Scope.To assess the constructive feasibility of se- lected elements of the CVA abstraction, an executable zero-knowledge authorization prototype was developed and publicly presented prior to the formalization in- troduced in this paper [22]. This artifact is the exper- imental precursor from which the present hypothes...

  6. [6]

    The preliminary model supports four principal ob- servations

    Discussion and Research Agenda—The pur- pose of the preliminary model is not only to propose a construction, but also to identify where the guarantees provided by ZKP-based authorization end. The preliminary model supports four principal ob- servations. First, the separation among binding layers: Identity Binding̸≡Authorization Request Binding ̸≡Runtime E...

  7. [7]

    ,then a valid proof may correspond to an incorrectly authorized decision. Policy governance, versioning via pidj, circuit governance, and verification-key distribu- tion therefore constitute first-class security concerns orthogonal to the cryptographic guarantees of the proof system. Third, dynamic execution introduces a time-of- check-to-time-of-use prob...

  8. [8]

    Limitations—We explicitly acknowledge the fol- lowing limitations:

Show all 41 references
  1. [9]

    The formal model is preliminary; complete security reductions for the proposed candidate properties to standard cryptographic assumptions remain as future work

  2. [10]

    The prototype has not been subjected to indepen- dent cryptographic circuit audit

  3. [11]

    The system is addi- tionally not post-quantum secure under current assumptions

    Groth16 requires a trusted setup ceremony; the resulting common reference string constitutes an external trust assumption. The system is addi- tionally not post-quantum secure under current assumptions

  4. [12]

    The encoded policy language is constrained to static arithmetic circuits; dynamic or procedural policies are not representable without circuit re- compilation

  5. [13]

    Context binding is included in the formal model throughHc(Encode(cpriv)) = hc, but is not imple- mented in the current prototype

  6. [14]

    Runtime execution binding is an open problem not addressed by the ZKP authorization layer alone, as formalized in Equation(41) and Equation(42)

  7. [15]

    No comparative empirical benchmark across proof systems has been conducted

  8. [16]

    No multi-agent or multi-principal delegation chain has been evaluated. 9

  9. [17]

    The authorization gateway is partially trusted; its compromise is outside the threat model of the core cryptographic construction

  10. [18]

    Conclusion—This paper argues that authoriza- tion for autonomous AI agents should be studied as a cryptographically verifiable security relation, rather thansolelyasaconsequenceofauthenticatedidentityor delegated credentials. We hypothesize that a meaning- ful class of authori...

  11. [19]

    The looming authorization crisis: Why traditional IAM fails agentic AI,

    V. Gupta, “The looming authorization crisis: Why traditional IAM fails agentic AI,” ISACA Industry News, Dec. 2025, ISACA

    2025

  12. [20]

    The OAuth 2.0 authorization framework,

    D. Hardt, “The OAuth 2.0 authorization framework,” Internet Engineering Task Force, Request for Com- ments 6749, 2012, doi: 10.17487/RFC6749

    2012 doi

  13. [21]

    Identity management for agentic AI: The new frontier of authorization, authen- tication, and security for an AI agent world,

    T. South, S. Nagabhushanaradhya, A. Dissanayaka, S. Cecchetti, G. Fletcher, V. Lu, A. Pietropaolo, D. H. Saxe, J. Lombardo, A. M. Shivalingaiah, S. Bounev, A. Keisner, A. Kesselman, Z. Proser, G. Fahs, A. Bun- yea, B. Moskowitz, A. Tulshibagwale, D. Greenwood, J. Pei, and A. P...

    2025

  14. [22]

    DIAP: A decentralized agent identity pro- tocol with zero-knowledge proofs and a hybrid P2P stack,

    Y. Liu, W. Xing, Y. Zhou, G. Chang, C. Lin, and M. Han, “DIAP: A decentralized agent identity pro- tocol with zero-knowledge proofs and a hybrid P2P stack,” arXiv preprint, 2025, arXiv:2511.11619

    2025

  15. [23]

    Binding agent ID: Unleashing the power of AI agents with accountability and credibility,

    Z. Lin, S. Zhang, G. Liao, D. Tao, and T. Wang, “Binding agent ID: Unleashing the power of AI agents with accountability and credibility,” arXiv preprint, 2025, arXiv:2512.17538

    2025

  16. [24]

    A novel zero-trust identity framework for agentic AI: Decentralized authentication and fine- grained access control,

    K. Huang, V. S. Narajala, J. Yeoh, J. Ross, M. Lambe, R. Raskar, Y. Harkati, J. Huang, I. Habler, and C. Hughes, “A novel zero-trust identity framework for agentic AI: Decentralized authentication and fine- grained access control,” in2026 IEEE International Conference on Artif...

    2026

  17. [25]

    The aegis protocol: A foundational security framework for autonomous AI agents,

    S. T. R. Adapala and Y. R. Alugubelly, “The aegis protocol: A foundational security framework for autonomous AI agents,” arXiv preprint, 2025, arXiv:2508.19267

    2025 arXiv

  18. [26]

    The knowl- edge complexity of interactive proof-systems,

    S. Goldwasser, S. Micali, and C. Rackoff, “The knowl- edge complexity of interactive proof-systems,” inPro- viding Sound Foundations for Cryptography: On the Work of Shafi Goldwasser and Silvio Micali. Associa- tion for Computing Machinery, 2019, pp. 203–225, doi: 10.1145/3335...

    2019

  19. [27]

    On the size of pairing-based non- interactive arguments,

    J. Groth, “On the size of pairing-based non- interactive arguments,” inAdvances in Cryptology— EUROCRYPT 2016, 2016, pp. 305–326, doi: 10.1007/ 978-3-662-49896-5_11

    2016

  20. [28]

    Scalable, transparent, and post-quantum secure com- putational integrity,

    E. Ben-Sasson, I. Bentov, Y. Horesh, and M. Riabzev, “Scalable, transparent, and post-quantum secure com- putational integrity,” Cryptology ePrint Archive, Pa- per 2018/046, 2018, ePrint:2018/046

    2018

  21. [29]

    Bulletproofs: Short proofs for confi- dential transactions and more,

    B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell, “Bulletproofs: Short proofs for confi- dential transactions and more,” in2018 IEEE Sympo- sium on Security and Privacy (SP), 2018, pp. 315–334, doi: 10.1109/SP.2018.00020

    2018

  22. [30]

    Zero-knowledge proof frameworks: A systematic survey,

    N. Sheybani, A. Ahmed, M. Kinsy, and F. Koushan- far, “Zero-knowledge proof frameworks: A systematic survey,” arXiv preprint, 2025, arXiv:2502.07063

    2025 arXiv

  23. [31]

    Zero-knowledge proofs for privacy- preserving systems: A survey across blockchain, iden- tity, andbeyond,

    S. Gupta, “Zero-knowledge proofs for privacy- preserving systems: A survey across blockchain, iden- tity, andbeyond,”Engineering and Technology Journal, vol. 10, no. 7, pp. 5755–5761, 2025, doi: 10.47191/etj/ v10i07.23. 10

    2025 doi

  24. [32]

    Zero-knowledge proofs and OAuth 2.0 for anonymity and security in distributed systems,

    A. Nait Cherif, Y. Achir, M. Youssfi, M. Elgarej, and O. Bouattane, “Zero-knowledge proofs and OAuth 2.0 for anonymity and security in distributed systems,” E3S Web of Conferences, vol. 469, 2023, art. no. 00085. doi: 10.1051/e3sconf/202346900085

    2023

  25. [33]

    Two-factor authentication for intellectual prop- erty transactions based on improved zero-knowledge proof,

    S. Mo, W. Feng, M. Huang, S. Feng, Z. Wang, and Y. Li, “Two-factor authentication for intellectual prop- erty transactions based on improved zero-knowledge proof,”Scientific Reports, vol. 15, no. 1, 2025, art. no

    2025

  26. [35]

    Secure blockchain-based single sign- on with zero-knowledge proof authentication,

    J. Xiang, O. Salem, A. Mehaoua, S. Wicha, and P. Sureephong, “Secure blockchain-based single sign- on with zero-knowledge proof authentication,” in2025 Global Information Infrastructure and Networking Sym- posium (GIIS), 2025, pp. 1–6, IEEE Xplore

    2025

  27. [36]

    Building a robust OAuth token based API security: A high level overview,

    S. Gopal, “Building a robust OAuth token based API security: A high level overview,” arXiv preprint, 2025, arXiv:2507.16870

    2025 arXiv

  28. [37]

    Zero-knowledge audit for Internet of Agents: Privacy-preserving communication verifi- cation with Model Context Protocol,

    G. Jing and H. Qi, “Zero-knowledge audit for Internet of Agents: Privacy-preserving communication verifi- cation with Model Context Protocol,” arXiv preprint, 2025, arXiv:2512.14737

    2025

  29. [38]

    AIP: Agent identity protocol for verifiable delegationacrossMCPandA2A,

    S. Prakash, “AIP: Agent identity protocol for verifiable delegationacrossMCPandA2A,”arXivpreprint, 2026, arXiv:2603.24775

    2026

  30. [39]

    Non-interactive and information- theoretic secure verifiable secret sharing,

    T. P. Pedersen, “Non-interactive and information- theoretic secure verifiable secret sharing,” inAdvances in Cryptology—CRYPTO ’91, 1992, pp. 129–140, doi: 10.1007/3-540-46766-1_9

    1992 doi

  31. [40]

    Poseidon: A new hash function for zero-knowledge proof systems,

    L. Grassi, D. Khovratovich, C. Rechberger, A. Roy, and M. Schofnegger, “Poseidon: A new hash function for zero-knowledge proof systems,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 519–535, USENIX

    2021

  32. [41]

    zk-auth-agent-demo: Prototype for zero- knowledge-based authorization in agentic systems,

    M. Llambí, “zk-auth-agent-demo: Prototype for zero- knowledge-based authorization in agentic systems,” GitHub repository, 2026, GitHub. † Corresponding author: mar.llambi@gmail.com 11

    2026

  33. [5974]

    doi: 10.1038/s41598-025-89597-7

    doi

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.