The core idea in Grimlock is separation of concerns for high-agency systems: agent code handles orchestration, while the sandbox
substrate enforces identity, authentication, authorization, provenance, and least-privilege delegation. Much of this is established security architecture; what I found
interesting is how the pieces are composed while leaving agent code unchanged.
eBPF provides no-bypass, application-transparent mediation at the sandbox boundary and associates ordinary socket flows with stable sandbox identities. Guard-to-guard
communication uses TLS 1.3 with kTLS for the data plane, allowing authentication context and longer-lived channels to amortize setup costs.
Post-handshake attestation is of special note. TLS exporters bind fresh TEE evidence to an already-established channel, including nonce, audience,
and requested delegation scope. Successful appraisal produces short-lived, channel-bound Scope Tokens that the destination guard revalidates before releasing plaintext to
the destination sandbox.
The most useful idea in TIRA: Task-Based Intermittent Remote Attestation is not that intermittent
systems can be made task-based, or that remote attestation can hash code and report a digest. What is interesting is the way the paper treats the task abstraction itself
as the unit of attestable progress.
The mechanism is a compiler/runtime co-design. Programmer-defined idempotent tasks are instrumented with software fault isolation; unsafe memory writes and control-flow
transfers are mediated through a Trusted Compute Module; a protected bootloader establishes static attestation at boot; and successful task transitions, interrupt
evidence, and mutable memory effects are folded into a cryptographically chained execution log.
The reported overheads are practical enough to make the design worth studying: about 18% runtime overhead and 4% code-size overhead on average. More broadly, the paper
suggests that in some constrained systems, the right attestation boundary may be the application’s execution abstraction, not just the boot image or hardware root.
Kettle turns build provenance from an assertion into hardware-rooted evidence. It runs builds inside a measured confidential VM,
records source, resolved dependencies, toolchain, environment, and output digests as SLSA/in-toto provenance, then commits the provenance hash into the TEE attestation
report. Verification becomes an attestation check plus digest comparisons rather than trusting CI infrastructure or reproducing the build.
The interesting part is the composition: Kettle reproducibly builds its own CVM image, providing a way to derive the expected launch
measurement; uses a Merkle commitment over build inputs; and can optionally attest the CVM before confidentially delivering source. Reproducibility answers whether another
build produces the same bytes; attestation proves that one measured environment actually observed specific inputs and produced specific bytes.
The broader lesson is that attestation can move build infrastructure outside the trust boundary—but verifier policy still determines which measured builders deserve trust.
ML provenance is not just software provenance with models added. The interesting problem is that datasets, code, configurations, weights, and execution environments are
coupled through transformations, while models can subsequently be fine-tuned or otherwise adapted. Atlas treats lineage as an authenticated chain of transformations rather
than simply an inventory of artifacts.
The individual mechanisms presented in the paper include Intel TDX, remote attestation, cryptographic measurements, C2PA manifests, and Merkle-tree transparency logs. What
I found interesting is their composition. An attestation client monitors PyTorch/Kubeflow execution, measures inputs and outputs, records runtime/configuration metadata,
and signs a transformation attestation containing hashes of precursor attestations. The transparency service makes these records tamper-evident; verification reconstructs
and validates the lineage.
More broadly, Atlas suggests that ML supply-chain integrity may require authenticating the transformation history, not merely signing the resulting model.
Remote Attestation with Constrained Disclosure
(2023) proposes a selective log disclosure mechanism for TPM-based
attestation. It uses non-interactive zero-knowledge (NIZK) proofs over IMA logs
to let systems prove integrity without revealing full software inventories.
The selective disclosure primitives introduced here are interesting beyond
privacy—for example, for fine-grained trust delegation across supply chains.