Pith. sign in

REVIEW 2 minor 24 references

Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions

T0 review · 0 major / 2 minor · reviewed 2026-06-28 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Receiving services can sign and publish encrypted receipts of AI agent calls so owners reconstruct tamper-evident trails without trusting the agent or its operator.

desk verdict Sello defines a receiver-signed receipt protocol for AI agents that works without trusting the agent or operator, but only if the receiving service stays honest. read the letter →

arxiv 2606.04193 v1 pith:CLZVD3OM submitted 2026-06-02 cs.CR cs.AIcs.DC

Juan Figuera This is my paper · ORCID
classification cs.CRcs.AIcs.DC
keywords AIagentstamper-evidentreceiptstransparencylogsobservabilityreceiverattestationHPKEencryptionMerkletreessecurityprotocols
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that AI agent activity logs are inherently unreliable when the agent or its operator produces them, since a compromised agent can omit, alter, or fabricate traces. It proposes protocols that move attestation to the receiving service, which signs a receipt of the observed call, encrypts it to the owner's key, and publishes the result to a public transparency log. The owner then uses token references to discover and verify the full sequence. A sympathetic reader cares because this creates an independent audit trail for autonomous systems where self-reported logs cannot be trusted. The concrete instantiation Sello combines receiver signing, HPKE encryption, Merkle-log publication, and owner discovery to achieve the property.

What carries the argument

Sello protocol combining receiver-side signing of observed calls, HPKE encryption to an owner public key bound to the authorization token, publication to a witness-cosigned Merkle log, and owner-side discovery by token reference.

What would settle it

An owner queries the public Merkle log by token reference for a call the service is known to have received and finds either no receipt or a receipt whose signature does not match the observed call contents.

Watch

Extended reading notes

Core claim

The paper claims that a class of receiver-attested receipt protocols, instantiated as Sello, lets the owner of an AI agent obtain a tamper-evident record of the agent's actions by having the receiving service sign what it observed, encrypt the receipt to the owner's public key (bound via JWS to the authorization token), publish it to a witness-cosigned Merkle transparency log, and enable owner-side discovery by token reference; under an adversary controlling the agent and operator, this yields a verifiable trail that the agent itself cannot suppress or rewrite.

Load-bearing premise

The receiving service will honestly sign and publish a receipt for every call it receives.

Editorial extensions

If this is right

  • Owners obtain an independent record that detects omission, alteration, or fabrication by the agent or operator.
  • Security holds against an adversary that fully controls the agent and its runtime environment.
  • The four properties (receiver signing, HPKE encryption, Merkle publication, token-based discovery) are absent from prior receipt systems such as Signet or SCITT.
  • Microbenchmarks confirm the cryptographic operations have practical cost for real deployments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same receiver-attestation pattern could apply to non-AI autonomous systems such as IoT devices or automated trading agents that interact with external services.
  • The known limitation of service collusion implies that deployment would require either regulatory mandates or economic incentives for services to participate honestly.
  • Periodic owner challenges or redundant receivers could mitigate the suppression attack that the paper lists as a remaining vulnerability.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 2 minor

Summary. The paper proposes Sello, a protocol class for receiver-attested confidential receipts for AI agent actions. The receiving service signs a receipt of the observed call using its own key, encrypts the receipt to the agent's owner via HPKE (with the owner public key bound to the authorization token via JWS), and publishes the receipt to a witness-cosigned Merkle transparency log. The owner can then discover and reconstruct a tamper-evident trail by token reference. Security is analyzed under an adversary controlling the agent and its operator; microbenchmarks of the cryptographic operations are presented; the protocol is situated relative to Signet, AgentROA, Agent Passport System, draft-farley-acta, and SCITT; and known limitations (suppression attack, service collusion, adoption-incentive problem) are explicitly listed.

Significance. If the security analysis holds under the stated model, the work supplies a concrete mechanism that inverts the trust boundary for AI-agent observability, enabling an owner to obtain independent attestation from the receiver rather than the agent itself. The explicit combination of (P1) receiver-side signing, (P2) HPKE+JWS binding, (P3) witness-cosigned Merkle log, and (P4) token-referenced discovery, together with the clear scoping of the adversary model and the enumeration of breaking limitations, constitutes a useful contribution to the receipt-protocol literature.

minor comments (2)
  1. [Abstract] § on microbenchmarks: the abstract states that microbenchmarks of the cryptographic operations are presented, but the hardware platform, library versions, and exact operations timed (e.g., HPKE seal vs. Merkle insertion) are not summarized; adding a one-sentence overview would improve reproducibility assessment.
  2. [Related work] Related-work section: the claim that the four properties are 'absent in any current system' would be strengthened by a short table explicitly mapping each cited system against (P1)–(P4).

Simulated Author's Rebuttal

0 responses · 0 unresolved

We thank the referee for the accurate summary of the manuscript and for the positive assessment of its contribution to receipt protocols for AI agents. The recommendation for minor revision is noted. However, the report lists no major comments, so we have no specific points to address.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; protocol definition with explicit scope

full rationale

The manuscript defines a protocol class (instantiated as Sello) via four properties (P1-P4) and analyzes security under an explicitly stated adversary model limited to agent/operator control. No equations, fitted parameters, predictions, or derivations appear; the central claim is scoped with listed limitations (suppression, collusion) that would invalidate it. No self-citation chain or ansatz is load-bearing. The work is self-contained as a protocol proposal.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

Review is abstract-only; the protocol rests on standard cryptographic assumptions for HPKE, JWS, and Merkle trees whose security is taken from prior literature.

assumptions (1)
  • standard math Security of HPKE, JWS signatures, and witness-cosigned Merkle trees under standard cryptographic assumptions
    Invoked to support the confidentiality, authenticity, and tamper-evidence claims.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions." pith.science (2026). https://pith.science/paper/CLZVD3OM

@misc{pith2026260604193,
  author       = {Pith},
  title        = {Pith review of: Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CLZVD3OM}},
  note         = {Machine review of arXiv:2606.04193}
}
read the original abstract

Current AI agent observability is structurally compromised: the entity producing the activity log is the same entity whose activity is being logged. A compromised or buggy agent can omit, alter, or fabricate its own traces, and the operator running the agent has no independent way to detect tampering. We propose a class of protocols that resolves this by inverting the trust boundary: the service that receives an agent's call signs a receipt of what it observed using its own key, encrypts the receipt to the agent's owner, and publishes it to a public transparency log. The owner reconstructs a tamper-evident trail without trusting the agent or its operator. We instantiate the class as Sello, a protocol combining four properties absent in any current system: (P1) receiver-side signing, (P2) HPKE encryption to an owner public key bound to the authorization token via JWS, (P3) publication to a witness-cosigned Merkle log, and (P4) owner-side discovery by token reference. We describe the protocol, analyze its security under an adversary that controls the agent and its operator, present microbenchmarks of the cryptographic operations, and situate Sello among adjacent receipt-protocol work (Signet, AgentROA, Agent Passport System, draft-farley-acta, SCITT). We discuss known limitations including the suppression attack, service collusion, and the adoption-incentive problem.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 3 canonical work pages

  1. [1]

    and Langley, A

    Laurie, B. and Langley, A. and Kasper, E. , title =

  2. [2]

    and Messeri, E

    Laurie, B. and Messeri, E. and Stradling, R. , title =

  3. [3]

    and Bradley, J

    Jones, M. and Bradley, J. and Sakimura, N. , title =

  4. [4]

    and Vigano, C

    Birkholz, H. and Vigano, C. and Bormann, C. , title =

  5. [5]

    , title =

    Schaad, J. , title =

  6. [6]

    and Bhargavan, K

    Barnes, R. and Bhargavan, K. and Lipp, B. and Wood, C. , title =

  7. [7]

    and Campbell, B

    Fett, D. and Campbell, B. and Bradley, J. and Lodderstedt, T. and Jones, M. and Waite, D. , title =

  8. [8]

    and Stute, M

    Heinrich, A. and Stute, M. and Kornhuber, T. and Hollick, M. , title =. Proceedings on Privacy Enhancing Technologies , volume =

Show all 24 references
  1. [9]

    and Tamas, I

    Syta, E. and Tamas, I. and Visher, D. and Wolinsky, D. I. and Jovanovic, P. and Gasser, L. and Gailly, N. and Khoffi, I. and Ford, B. , title =. IEEE Symposium on Security and Privacy , pages =

  2. [10]

    Bernstein, D. J. and Duif, N. and Lange, T. and Schwabe, P. and Yang, B. , title =. Journal of Cryptographic Engineering , volume =

  3. [11]

    , title =

    Figuera, J. , title =

  4. [12]

    and Delignat-Lavaud, A

    Birkholz, H. and Delignat-Lavaud, A. and Fournet, C. and Deshpande, Y. and Lasker, S. , title =

  5. [13]

    and Birkholz, H

    Steele, O. and Birkholz, H. , title =

  6. [14]

    and others , title =

    Delignat-Lavaud, A. and others , title =

  7. [15]

    , title =

    Jongerius, O. , title =

  8. [16]

    , title =

    Pidlisnyi, T. , title =

  9. [17]

    , title =

    Farley, T. , title =

  10. [18]

    , title =

    Michalak, J. , title =

  11. [19]

    , title =

    Kamimura, S. , title =

  12. [20]

    , title =

    Zhang, J. , title =. arXiv preprint arXiv:2602.20214 , year =

  13. [21]

    , title =

    Gupta, A. , title =. arXiv preprint arXiv:2512.17259 , year =

  14. [22]

    , title =

    Basu, A. , title =. arXiv preprint arXiv:2603.10060 , year =

  15. [23]

    Black-Box

    Casper, Stephen and Ezell, Carson and Siegmann, Charlotte and Kolt, Noam and Curtis, Taylor Lynn and Bucknall, Benjamin and Haupt, Andreas and Wei, Kevin and Scheurer, J. Black-Box. Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT) , pages =

    2024

  16. [24]

    and Omolola, O

    Kales, D. and Omolola, O. and Ramacher, S. , title =. IEEE European Symposium on Security and Privacy , year =

Pith tools

Reviewed June 28, 2026 · model on record in the stance chip above.