remote attestation

The existing Software Verification Witnesses format (v2.0) lacks structured support for function contracts—i.e., preconditions and postconditions—hindering result reproducibility and interoperability across verification tools. Method: We introduce function-contract semantics into the witness format for the first time, extending its XML Schema to support ACSL-style features (e.g., ` esult`, `old`, `at`), thereby overcoming its prior limitation to loop invariants and location assertions. We formally model contract syntax and adapt static analysis tool interfaces to enable standardized, function-level correctness evidence exchange. Contribution/Results: This extension enables precise, tool-agnostic representation of contract-based verification evidence, significantly improving accuracy, trustworthiness, and reproducibility in multi-tool collaborative verification. It establishes a novel paradigm for semantic enhancement and standardization of verification witnesses, advancing interoperable, contract-aware software verification infrastructure.

This work addresses the challenge of efficiently verifying whether an AI agent’s behavior adheres to a prescribed policy without relying on trust in the agent or re-executing its computations. The authors propose a novel paradigm that integrates formal methods with cryptographic proofs: policy specifications are encoded as logical predicates, compiled into polynomial constraints, and used to generate succinct, independently verifiable certificates via Succinct Non-interactive Arguments of Knowledge (SNARKs), optionally with zero-knowledge guarantees. This framework enables an end-to-end transformation from high-level policy statements to verifiable evidence, facilitating trustless compliance auditing and bridging the gap between AI governance, deployment, and formal verification.

RISC-V binary programs lack trustworthy verification, and bridging the semantic gap between high-level source code and actual hardware execution remains challenging. Method: This paper presents the first fully automated, mathematically verifiable binary-level formal verification framework for RISC-V, built on the HOL4 theorem prover and the HolBA library. It employs the Binary Intermediate Representation (BIR) as a unifying abstraction, integrates forward symbolic execution, and leverages a complete, machine-checked formal semantics of the RISC-V instruction set architecture to enable end-to-end binary contract verification. Contribution/Results: Crucially, the framework eliminates trust dependencies introduced by compiler optimizations and inline assembly. Experimentally, it achieves full verification of the ChaCha20 encryption algorithm’s RISC-V binary implementation and OS kernel context-switching assembly code—marking the first provably correct, end-to-end verification chain from source-level specification to concrete machine-code behavior on RISC-V.

Hardware-secured remote attestation is essential to establishing trust in the integrity of confidential virtual machines (cVMs), but is difficult to use in practice because verifying attestation evidence requires the use of hardware-specific cryptographic logic. This increases both maintenance costs and the verifiers'trusted computing base. We introduce the concept of self-verifying remote attestation evidence. Each attestation bundle includes verification logic as a WebAssembly component signed by a trusted party. This approach transforms evidence verification into a standard code-signing problem: the verifier checks the signature on the embedded logic and then executes it to validate the evidence. As a result, verifiers can validate attestation evidence without any platform-specific knowledge. We implement this concept as TrustMee, a platform-agnostic verification driver for the Trustee framework. We demonstrate its functionality with self-verifying evidence for AMD SEV-SNP and Intel TDX attestations, producing attestation claims in the standard EAT Attestation Result (EAR) format.

Current large language model (LLM) agents lack systematic security guarantees throughout the entire pipeline from user intent to execution, rendering them vulnerable to attacks when interacting with untrusted tools and data. This work introduces, for the first time, the concept of “intent-to-execution integrity,” drawing an analogy to compiler architecture to formally define four core integrity properties—tool, instruction, judgment, and dataflow—and constructs an end-to-end security framework grounded in these principles. The study exposes critical limitations in existing defense mechanisms, particularly their non-compositional nature and insufficient coverage, thereby establishing a theoretical foundation and a unified evaluation standard for assessing and building truly trustworthy LLM agents.

This work addresses a central challenge in system security: formally verifying that system designs and implementations satisfy intended safety properties and support security certification. The authors propose a systematic approach grounded in proof assistants, integrating interactive theorem proving and formal methods to precisely model and machine-check critical security properties across diverse domains—including system security, language-level security, secure compilation, and cryptography. By enabling rigorous, machine-verifiable proofs of correctness, this methodology significantly strengthens the formal assurance of security properties and provides a unified theoretical framework and toolchain for constructing verifiable and certifiable secure systems.

This work addresses the challenge of ensuring trustworthy AI behavior in high-stakes, heavily regulated environments, where reliance solely on generative models, output safeguards, or post-hoc audits proves insufficient to prevent unacceptable execution trajectories. To this end, the paper introduces the Proposal–Certification–Execution (PCE) framework, which formalizes trajectory permissibility as an explicit safety property requiring prior certification. Central to PCE are the Permissibility Machine and a verifiable certificate mechanism that enforce a “no certificate, no execution” policy, thereby providing pre-execution trust guarantees. Integrating a policy system Π, a language for executable trajectories, proof-carrying execution, and privacy-preserving techniques, the framework establishes a structured pre-execution certification process and advances a new evaluation paradigm centered on certifiably permissible trajectories—shifting trustworthy AI from output monitoring toward pre-execution verification.

This work addresses the prevalent issue in autonomous coding agents that prematurely declare lifecycle states—such as “DONE”—without verification during multi-step software tasks, often leading to erroneous progression. To mitigate this, the authors propose Proof-or-Stop, a model-agnostic and platform-neutral trusted control layer that strictly gates state transitions only when fresh, traceable, and mechanically verifiable evidence satisfies predefined conditions. Crucially, the approach treats agent outputs as claims pending validation rather than established facts, and explicitly distinguishes between the mere existence of review mechanisms and their role as gating criteria. Empirical evaluation demonstrates zero false “DONE” declarations across ten scenarios, successful resistance against 18 classes of tampering attacks with no false acceptances, and a reduction in hidden failure rates from 31/1800 to 2/1800 in ablation studies. Furthermore, 94.8% of issues in a corpus of 565 self-application narratives were resolved.

This work addresses subtle vulnerabilities in zkEVM implementations—such as incorrect gas computations—that can yield semantically flawed yet formally valid zero-knowledge proofs, thereby compromising system security. Existing formal verification approaches rely on manually crafted specifications, limiting their scalability. To overcome this, the paper introduces VeriSynth, a novel hybrid framework that uniquely combines large language models (LLMs) as a formalization frontend with SMT solvers as correctness oracles. Through semantic decomposition, retrieval-augmented prompting, and verification-guided self-repair, VeriSynth automatically translates Rust-based zkEVM opcodes into executable symbolic constraint models in Python/Z3, enabling closed-loop constraint synthesis and repair. Evaluated on the first source-level zkEVM verification benchmark, VeriSynth achieves over 90% vulnerability detection accuracy, substantially outperforming pure LLM approaches, conversational baselines, and industrial-grade handcrafted test suites, with ablation studies confirming the necessity of each component.

This work addresses the challenge of jointly verifying functional correctness and timing side-channel leakage in RTL processor designs by proposing a modular methodology that, for the first time, formally connects ISA-level leakage contracts with cycle-accurate microarchitectural execution. Leveraging leakage-aware refinement verification and deterministic trace equivalence, the approach uniformly guarantees both functional correctness and confidentiality. It employs existentially quantified public-parameterized specifications, modular compositional verification, and Coq/Rocq proof techniques integrated with certified static analysis. The method delivers end-to-end formal assurance for complete processor designs featuring speculative execution, precise interrupts, and I/O, and automatically derives cycle-level confidentiality theorems for software and hardware cryptographic implementations.