Skip to content

Trusted AI Agents in the Cloud

🕒 Published (v1): 2025-12-05 18:48 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Omega is a trusted runtime for cloud-hosted AI agents that enforces end-to-end isolation, cross-principal trust, and auditable policy enforcement using AMD SEV-SNP Confidential VMs and NVIDIA H100 Confidential GPUs. It consolidates multiple agents within a single CVM via hardware-enforced privilege levels (VMPLs), reducing boot and attestation overhead while matching the density of container-based deployments. Its policy framework is validated against the MCP-SecBench benchmark to block real-world attacks without degrading agent functionality.

Problem

Existing Confidential VMs (CVMs) provide only per-binary, CPU-memory-level protection and cannot address: (1) GPU memory exposure to the hypervisor during LLM inference; (2) the absence of cross-principal trust—agents depend on models, LoRA adapters, and tools from separate untrusted providers; (3) no mechanism for fine-grained behavioral supervision or tamper-evident provenance of tool invocations and inter-agent messages. Per-agent CVM deployments also scale poorly: boot times ≈18.12 s, p50/p99 scheduling delays of 1,827/38,364 ms, and a hard limit of ≈500 CVMs per host.

Method

Omega organizes a single CVM into three AMD SEV-SNP VMPL levels: a trusted monitor at VMPL-0 (boots the hierarchy, hosts a vTPM), a Trusted Agent Platform (TAP) at VMPL-1 (Direct I/O engine for sealed storage, CGPU subsystem with SPDM-secured channels to NVIDIA H100), and agent processes at VMPL-2 (page-level isolation between co-located agents). An agent orchestrator at VMPL-1 intercepts every MCP tool call and A2A inter-agent message, validates them against declaratively-specified per-user policies before execution, and appends cryptographically-protected provenance tokens to a tamper-evident log.

For trust establishment, differential attestation separates immutable platform measurements (CVM hardware, CGPU, runtime) from mutable components (agent images, LoRA weights, I/O state); only the mutable delta is re-attested per action, shrinking attestation latency from 25.73 s (full CVM) to 0.10 s. Co-located agents communicate via shared-memory objects rather than network stacks, eliminating TLS copy overhead. Agents inherit a structured supervisor API (select_model, select_lora, launch, configure_mcp, configure_a2a) and a runtime API (llm, call_mcp, call_a2a, save_state) that the orchestrator mediates.

Key Contributions

  • Nested isolation in a single CVM: packs \(n\) agents at VMPL-2 with hardware-enforced page-level separation, achieving container-like density while extending confidentiality to GPU memory.
  • CGPU integration: mutual attestation between SEV-SNP CVM and NVIDIA H100 via SPDM, protecting model weights and inference results against the hypervisor.
  • Differential attestation protocol: binds all contributing principals (model, LoRA, adapter, peer agents) into a unified attested agent identity while reusing pre-computed platform measurements.
  • Declarative policy and enforcement framework: isolated enforcement engine validates tool/A2A actions before execution; tamper-evident cryptographic log supports retroactive compliance verification.
  • Direct I/O engine: sealed storage for agent state and audit logs, closing the IOPS gap vs. bare-metal (629K/285K) while maintaining confidentiality guarantees.

Results

  • Attestation latency: Omega differential attestation 0.10 s vs. 25.73 s for full CVM attestation; boot time 0.03 s vs. 18.12 s.
  • Memory density: Omega agents consume significantly less memory per agent than per-agent CVMs, approaching container-level density (Figure 2a, exact numbers per-agent not quoted).
  • Storage IOPS: VM reaches 380K/247K IOPS (4KB rand R/W); CVM reaches 273K/207K; bare metal 629K/285K—kernel mediation is the bottleneck Omega's Direct I/O engine addresses.
  • Scheduling delay (Azure trace, 12 h, 10,000 agents, 1M prompts): per-agent CVM p50/p99 = 1,827/38,364 ms vs. container p50/p99 baseline; per-agent CVM slowdown p50/p99 = 1.04×/3.76×.
  • Inter-agent communication: Omega reduces latency by over an order of magnitude compared to per-agent CVMs.
  • Security: Omega's policy framework prevents a range of real-world attacks on MCP-SecBench without degrading agent functionality.
  • Overall: Omega matches performance of non-confidential deployments while exceeding CVM scalability limits (≈500/host) and GPU MIG limits (7 instances).

Limitations

  • Does not defend against physical attacks, side-channel attacks, or denial-of-service.
  • Assumes the confidential computing hardware (AMD SEV-SNP, NVIDIA H100 CGPU) functions correctly and that standard cryptographic primitives are secure.
  • Once a component is validated by attestation, subsequent compromise of that component is not defended against.
  • Relies on cloud infrastructure providing SEV-SNP + CGPU capabilities, limiting deployment portability.
  • Agent non-determinism means policies constrain but cannot fully predict agent behavior; the system enforces constraints on outputs/actions, not on internal reasoning.

Relevance to Harnesses / Meta-Harnesses

Omega is a trusted meta-harness substrate: it provides the security-critical orchestration layer that a multi-agent harness relies on—routing tasks, enforcing policies, managing agent lifecycle, and attesting the full principal chain—without which a harness cannot make safety or compliance guarantees about delegated actions. Its declarative policy language and isolated enforcement engine directly parallel the "harness-as-policy-enforcer" pattern, and its supervisor API (launch, configure_mcp, configure_a2a) is essentially a typed harness API with hardware-backed invariants. For researchers building or analyzing meta-harnesses that orchestrate heterogeneous agents over MCP/A2A, Omega establishes what the minimum trusted computing base for such a harness must look like when operating in an adversarial cloud environment, and its differential attestation protocol is a concrete mechanism for compositional trust that harness designers must either replicate or delegate to a system like Omega.