Search papers, labs, and topics across Lattice.
This paper introduces AEGIS, an attested API router designed to secure interactions between clients and large language models (LLMs) by confining plaintext handling to a hardware enclave. The significance of this approach lies in its ability to prevent various malicious router attacks that exploit plaintext access, which traditional client-side defenses fail to mitigate. Experimental results demonstrate that AEGIS effectively blocks all tested attack classes while maintaining performance, with minimal overhead and seamless integration with existing APIs.
AEGIS blocks all malicious router attacks that exploit plaintext access, showcasing a robust defense against a growing threat in LLM interactions.
Agents increasingly access large language models (LLMs) through API routers. A router terminates the client's transport-layer security session and opens a separate upstream session, so it holds the full interaction in plaintext. This makes the router an application-layer man-in-the-middle: it can rewrite agent tool calls, swap dependencies for typosquatted packages, trigger attacks only under audit-evading conditions, and passively exfiltrate secrets. Existing client-side defenses are evadable. We propose AEGIS, a provider-transparent attested API router whose data path is a client-verified faithful passthrough. AEGISconfines plaintext handling to a small hardware-enclave component while leaving authentication, scheduling, accounting, and management on the untrusted host. The client verifies the enclave before releasing plaintext. The host can neither read nor alter the interaction, and plaintext leaves only toward destinations fixed by the measured image. We show that all four malicious-router attack classes succeed against a plaintext-access baseline and are blocked by AEGIS, including adaptive tests against the same boundary. The trusted path is $851$ lines, carries three provider-native APIs without conversion, and completes every request under real-provider workload and concurrency. In a seeded audit pilot, two commodity coding agents find eight and ten of ten planted invariant violations. The local relay overhead is about six milliseconds per request.
