{"id":"https://openalex.org/W7164937693","doi":"https://doi.org/10.48550/arxiv.2606.16358","title":"The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs","display_name":"The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs","publication_year":2026,"publication_date":"2026-06-15","ids":{"openalex":"https://openalex.org/W7164937693","doi":"https://doi.org/10.48550/arxiv.2606.16358"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.16358","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.16358","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.16358","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5011688344","display_name":"Sipeng Xie","orcid":"https://orcid.org/0009-0002-6199-5673"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xie, Sipeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019206078","display_name":"Qile Wu","orcid":"https://orcid.org/0009-0003-1096-1892"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Qianhong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002110978","display_name":"Hengrun Lu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lu, Hengrun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138709964","display_name":"Ziliang Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Ziliang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019206078","display_name":"Qile Wu","orcid":"https://orcid.org/0009-0003-1096-1892"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Qi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138705564","display_name":"Bo Qin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qin, Bo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138716701","display_name":"Qin Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Qin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.38760000467300415,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.38760000467300415,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10651","display_name":"IPv6, Mobility, Handover, Networks, Security","score":0.06830000132322311,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.06199999898672104,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/router","display_name":"Router","score":0.5192999839782715},{"id":"https://openalex.org/keywords/swap","display_name":"Swap (finance)","score":0.48820000886917114},{"id":"https://openalex.org/keywords/plaintext","display_name":"Plaintext","score":0.4462999999523163},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.40119999647140503},{"id":"https://openalex.org/keywords/scheduling","display_name":"Scheduling (production processes)","score":0.37790000438690186},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.3521000146865845},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.33329999446868896},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.32690000534057617},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.3253999948501587}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6998000144958496},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.6366999745368958},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.5192999839782715},{"id":"https://openalex.org/C99821215","wikidata":"https://www.wikidata.org/wiki/Q1136583","display_name":"Swap (finance)","level":2,"score":0.48820000886917114},{"id":"https://openalex.org/C92717368","wikidata":"https://www.wikidata.org/wiki/Q1162538","display_name":"Plaintext","level":3,"score":0.4462999999523163},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44029998779296875},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.43209999799728394},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.40119999647140503},{"id":"https://openalex.org/C206729178","wikidata":"https://www.wikidata.org/wiki/Q2271896","display_name":"Scheduling (production processes)","level":2,"score":0.37790000438690186},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.3521000146865845},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.33329999446868896},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.32690000534057617},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.3253999948501587},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.3066999912261963},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C96324660","wikidata":"https://www.wikidata.org/wiki/Q205446","display_name":"Dataflow","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.29440000653266907},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.28110000491142273},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.27649998664855957},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.2757999897003174},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.26589998602867126},{"id":"https://openalex.org/C195219913","wikidata":"https://www.wikidata.org/wiki/Q13162","display_name":"Internet Control Message Protocol","level":3,"score":0.257099986076355},{"id":"https://openalex.org/C9996903","wikidata":"https://www.wikidata.org/wiki/Q1749235","display_name":"Cryptographic nonce","level":3,"score":0.25679999589920044},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.2556000053882599},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.25279998779296875}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.16358","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.16358","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.16358","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.16358","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5395963191986084,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Agents":[0],"increasingly":[1],"access":[2],"large":[3],"language":[4],"models":[5],"(LLMs)":[6],"through":[7],"API":[8,71],"routers.":[9],"A":[10],"router":[11,35,72],"terminates":[12],"the":[13,27,34,97,103,115,125,150],"client's":[14],"transport-layer":[15],"security":[16],"session":[17],"and":[18,56,94,117,141,165,172,185],"opens":[19],"a":[20,68,77,85,138,175],"separate":[21],"upstream":[22],"session,":[23],"so":[24],"it":[25,39],"holds":[26],"full":[28],"interaction":[29],"in":[30],"plaintext.":[31,107],"This":[32],"makes":[33],"an":[36],"application-layer":[37],"man-in-the-middle:":[38],"can":[40,110],"rewrite":[41],"agent":[42],"tool":[43],"calls,":[44],"swap":[45],"dependencies":[46],"for":[47],"typosquatted":[48],"packages,":[49],"trigger":[50],"attacks":[51],"only":[52,120],"under":[53,169],"audit-evading":[54],"conditions,":[55],"passively":[57],"exfiltrate":[58],"secrets.":[59],"Existing":[60],"client-side":[61],"defenses":[62],"are":[63,142],"evadable.":[64],"We":[65,128],"propose":[66],"AEGIS,":[67,145],"provider-transparent":[69],"attested":[70],"whose":[73],"data":[74],"path":[75,155],"is":[76,156,196],"client-verified":[78],"faithful":[79],"passthrough.":[80],"AEGISconfines":[81],"plaintext":[82,118],"handling":[83],"to":[84],"small":[86],"hardware-enclave":[87],"component":[88],"while":[89],"leaving":[90],"authentication,":[91],"scheduling,":[92],"accounting,":[93],"management":[95],"on":[96],"untrusted":[98],"host.":[99],"The":[100,108,153,192],"client":[101],"verifies":[102],"enclave":[104],"before":[105],"releasing":[106],"host":[109],"neither":[111],"read":[112],"nor":[113],"alter":[114],"interaction,":[116],"leaves":[119],"toward":[121],"destinations":[122],"fixed":[123],"by":[124,144],"measured":[126],"image.":[127],"show":[129],"that":[130],"all":[131],"four":[132],"malicious-router":[133],"attack":[134],"classes":[135],"succeed":[136],"against":[137,149],"plaintext-access":[139],"baseline":[140],"blocked":[143],"including":[146],"adaptive":[147],"tests":[148],"same":[151],"boundary.":[152],"trusted":[154],"$851$":[157],"lines,":[158],"carries":[159],"three":[160],"provider-native":[161],"APIs":[162],"without":[163],"conversion,":[164],"completes":[166],"every":[167],"request":[168],"real-provider":[170],"workload":[171],"concurrency.":[173],"In":[174],"seeded":[176],"audit":[177],"pilot,":[178],"two":[179],"commodity":[180],"coding":[181],"agents":[182],"find":[183],"eight":[184],"ten":[186,188],"of":[187],"planted":[189],"invariant":[190],"violations.":[191],"local":[193],"relay":[194],"overhead":[195],"about":[197],"six":[198],"milliseconds":[199],"per":[200],"request.":[201]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-17T00:00:00"}