From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows

2026-07-16

AI Summary

This work addresses the vulnerability of existing key management services to prompt injection attacks, stemming from their inability to verify alignment between AI agent runtime behavior and user intent. To mitigate this, the paper introduces Neural Cryptographic Service (NCS), the first framework integrating cryptographic authorization with neuro-symbolic control. In NCS, a neural planner generates an initial action plan, while a symbolic controller enforces parameter binding, fine-grained authorization, and tamper-proof execution for each tool invocation, leveraging offline digital signatures and hash chains. This approach enables auditable, deterministic runtime governance, reducing attack success rates to near zero on both AgentDojo and custom benchmarks while preserving high availability for legitimate tasks.

Abstract

The rapid adoption of artificial intelligence (AI)-driven and agentic workflows is transforming traditional government and enterprise systems into language-based, tool-using and increasingly autonomous infrastructures. Conventional key management services authenticate who may invoke a cryptographic primitive, but remain agnostic to which workflow steps are authorized at runtime: an authenticated agent can still be hijacked by direct or indirect prompt injection into executing malicious actions that satisfy identity checks yet violate user intent. We present \emph{Neural Cryptographic Services} (NCS), an active security governance plane grounded in a neural-symbolic design and interposed between LLM agents and privileged tools. Under NCS, an untrusted neural planner compiles natural-language instructions into structured plan drafts but holds no execution authority. Execution is instead gated by a deterministic symbolic controller operating over an offline-signed, hash-chained instruction stream. NCS verifies the signature, incrementally validates the hash chain, releases exactly one instruction payload at a time, and enforces strict binding between the agent's proposed tool parameters and the verified payload. Mismatched or out-of-order tool calls are rejected fail-closed, while previously verified states are retained for post-hoc auditing. We evaluate NCS on AgentDojo and a custom argument-hijacking benchmark. NCS drives attack success rates to near zero while preserving acceptable utility on benign workflows. NCS thus reframes agent security from asking whether a model's intent complied to asking whether a proposed dispatch matches a cryptographically authorized step.

Problem

• AI agents
• cryptographic authorization
• prompt injection
• workflow security
• intent compliance

Innovation

• Neural Cryptographic Services
• agentic workflows
• prompt injection defense
• neural-symbolic security
• hash-chained authorization