ML Security PapersAgenTEE: Confidential LLM Agent Execution on Edge Devices
Sina Abdollahi 1, Mohammad M Maheri 1, Javad Forough 1, Amir Al Sadi 1, Josh Millar 1, David Kotz 2, Marios Kogias 1, Hamed Haddadi 1
Published on arXiv
2604.18231
AI Supply Chain Attacks
OWASP ML Top 10 — ML06
Insecure Plugin Design
OWASP LLM Top 10 — LLM07
Excessive Agency
OWASP LLM Top 10 — LLM08
Key Finding
Achieves less than 5.15% runtime overhead compared to commodity OS multi-process deployments while providing strong isolation of model weights and system prompts
AgenTEE
Novel technique introduced
Large Language Model (LLM) agents provide powerful automation capabilities, but they also create a substantially broader attack surface than traditional applications due to their tight integration with non-deterministic models and third-party services. While current deployments primarily rely on cloud-hosted services, emerging designs increasingly execute agents directly on edge devices to reduce latency and enhance user privacy. However, securely hosting such complex agent pipelines on edge devices remains challenging. These deployments must protect proprietary assets (e.g., system prompts and model weights) and sensitive runtime state on heterogeneous platforms that are vulnerable to software attacks and potentially controlled by malicious users. To address these challenges, we present AgenTEE, a system for deploying confidential agent pipelines on edge devices. AgenTEE places the agent runtime, inference engine, and third-party applications into independently attested confidential virtual machines (cVMs) and mediates their interaction through explicit, verifiable communication channels. Built on Arm Confidential Compute Architecture (CCA), a recent extension to Arm platforms, AgenTEE enforces strong system-level isolation of sensitive assets and runtime state. Our evaluation shows that such multi-cVMs system is practical, achieving near-native performance with less than 5.15% runtime overhead compared to commodity OS multi-process deployments.
Key Contributions
- Multi-cVM architecture isolating agent runtime, inference engine, and third-party tools with independent attestation
- Implementation on Arm Confidential Compute Architecture (CCA) for edge device deployment
- Explicit verifiable communication channels mediating interactions between isolated components
🛡️ Threat Analysis
Protects the ML infrastructure and agent pipeline against compromise on edge devices - defends model weights, system prompts, and runtime state from software attacks and malicious device owners using hardware-based isolation.