CoChat
Sign Up
PreprintCited by 1Advanced Authentication Protocols SecurityAccess Control and TrustCryptography and Data Security

Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms

Open access
Deochake, Saurabh·2026·arXiv
DOI 10.48550/arxiv.2605.20704arXiv 2605.20704
Open this paper in CoChat — free accountOpen PDF

Abstract

Autonomous AI agents that spawn sub-agent swarms create a safety gap: existing credential revocation mechanisms, OAuth~2.0 introspection, OCSP, and W3C Status Lists, require network connectivity to a central authority, leaving ``zombie agents'' executing privileged operations for minutes to hours after operator shutdown. We present Heartbeat-Bound Hierarchical Credentials (HBHC), a cryptographic protocol that binds credential validity to periodic parent liveness proofs. Verifiers enforce freshness using only a cached public key and local clock; no network round-trip is required. When heartbeat generation ceases, all descendant credentials become unusable within a deterministically bounded window $W_z \le W_{\max} + Δ_h + ε$, conditional on bounded clock skew and parent keys held in secure enclaves. Evaluation at the protocol layer and with real LLM-backed agent swarms (GPT-4o-mini) demonstrates a 90$\times$ reduction in the zombie window over OAuth~2.0, 0.26~ms full authentication in Rust, 18,000+ verifications per second under concurrent HTTP load, and stable per-verification latency from 10 to 10,000 agents. Real-agent experiments show 0.71\% end-to-end overhead on tool calls, zero post-revocation tool calls under prompt injection that bypasses application-layer guardrails, and cascading revocation across a 49-agent four-level hierarchy within the theoretical bound.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2605.20704

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Heartbeat-Bound Hierarchical Credentials establishes cascading revocation in an agent hierarchy by requiring periodic parent liveness proofs and bounding the resulting zombie window under its timing and key assumptions.

    “Heartbeat-Bound Hierarchical Credentials (HBHC) already establishes cascading revocation in an agent hierarchy by requiring periodic parent liveness proofs and bounding the resulting zombie window under its timing and key assumptions [8].”

    From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [8]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 25

  1. Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., Mané, D.: Concrete problems in AI safety. arXiv preprint arXiv:1606.06565 (2016). https://doi.org/10.48550/arXiv.1606.06565 · DOI · Paper page
  2. Birgisson, A., Politz, J.G., Úlfar Erlingsson, Taly, A., Vrable, M., Lentczner, M.: Macaroons: Cookies with contextual caveats for decentralized authoriza- tion in the cloud. In: Proceedings of the Network and Distributed System Security Symposium (NDSS) (2014)
  3. Burrows, M.: The chubby lock service for loosely-coupled distributed sys- tems. In: Proceedings of the 7th USENIX Symposium on Operating Sys- tems Design and Implementation (OSDI). pp. 335-350. USENIX Associa- tion (2006)
  4. Camenisch, J., Lysyanskaya, A.: Dynamic accumulators and application to efficient revocation of anonymous credentials. In: Advances in Cryptology -CRYPTO 2002. LNCS, vol. 2442, pp. 61-76. Springer (2002). https: //doi.org/10.1007/3-540-45708-9_5 · DOI
  5. Chandra, T.D., Toueg, S.: Unreliable failure detectors for reliable dis- tributed systems. Journal of the ACM 43(2), 225-267 (1996). https: //doi.org/10.1145/226643.226647 · DOI
  6. Chuat, L., Abdou, A., Sasse, R., Sprenger, C., Basin, D., Perrig, A.: SoK: Delegation and revocation, the missing links in the web's chain of trust. In: Proceedings of the IEEE European Symposium on Security and Pri- vacy (EuroS&P). pp. 624-638. IEEE (2020). https://doi.org/10.1109/ EuroSP48549.2020.00046 · DOI
  7. Colombatto, A., Giorgino, L., Vesco, A.: An identity key management sys- tem with deterministic key hierarchy for SSI-native Internet of Things. In: Proceedings of the 19th International Conference on Availability, Reliability and Security (ARES). ACM (2024). https://doi.org/10.1145/3664476. 3669929 · DOI
  8. Costan, V., Devadas, S.: Intel SGX explained. IACR Cryptology ePrint Archive 2016, 86 (2016), https://eprint.iacr.org/2016/086
  9. Deng, Z., Guo, Y., Han, C., Ma, W., Xiong, J., Wen, S., Xiang, Y.: AI agents under threat: A survey of key security challenges and future path- ways. ACM Computing Surveys 57(7), 182 (2025). https://doi.org/10. 1145/3716628 · DOI · Paper page
  10. Deochake, S., Channapattan, V.: Identity and access management frame- work for multi-tenant resources in hybrid cloud computing. In: Proceedings of the 17th International Conference on Availability, Reliability and Security (ARES). ACM (2022). https://doi.org/10.1145/3538969.3544896 · DOI
  11. Deochake, S., Murphy, R., Gearheart, J.: A multi-cloud framework for zero-trust workload authentication. arXiv preprint arXiv:2510.16067 (2025). https://doi.org/10.48550/arXiv.2510.16067 · DOI
  12. Dolev, D., Yao, A.C.: On the security of public key protocols. IEEE Trans- actions on Information Theory 29(2), 198-208 (1983). https://doi.org/ 10.1109/TIT.1983.1056650 · DOI
  13. European Parliament and Council of the European Union: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI act). Official Journal of the European Union (2024), article 9: Risk Management; Article 14: Human Oversight
  14. Gabriel, I., Manzini, A., Keeling, G., Hendricks, L.A., Rieser, V., Iqbal, H., Tomašev, N., Ktena, I., Kenton, Z., Rodriguez, M., El-Sayed, S., Brown, S., Blunsom, P., Isaac, W.: The ethics of advanced AI assistants. arXiv preprint arXiv:2404.16244 (2024). https://doi.org/10.48550/arXiv.2404.16244 · DOI · Paper page
  15. Garzon, S.R., Vaziry, A., Kuzu, E.M., Gehrmann, D.E., Varkan, B., Ga- balla, A., Küpper, A.: AI agents with decentralized identifiers and verifiable credentials. arXiv preprint arXiv:2511.02841 (2025) · arXiv
  16. Goswami, A.: Agentic JWT: A secure delegation protocol for autonomous AI agents. arXiv preprint arXiv:2509.13597 (2025). https://doi.org/10. 48550/arXiv.2509.13597 · DOI · Paper page
  17. Gray, C.G., Cheriton, D.R.: Leases: An efficient fault-tolerant mechanism for distributed file cache consistency. In: Proceedings of the 12th ACM Symposium on Operating Systems Principles (SOSP). pp. 202-210. ACM (1989). https://doi.org/10.1145/74851.74870 · DOI
  18. Gu, X., Zheng, X., Pang, T., Du, C., Liu, Q., Wang, Y., Jiang, J., Lin, M.: Agent smith: A single image can jailbreak one million multimodal LLM agents exponentially fast. In: Proceedings of the 41st International Confer- ence on Machine Learning (ICML) (2024)
  19. Hammond, L., Chan, A., Clifton, J., Hoelscher-Obermaier, J., Khan, A., McLean, E., Smith, C., Barfuss, W., Foerster, J., Gavenčiak, T., Han, T.A., Hughes, E., Kovařík, V., Kulveit, J., Leibo, J.Z., Oesterheld, C., de Witt, C.S., Shah, N., Wellman, M., Bova, P., Cimpeanu, T., Ezell, C., Feuillade- Montixi, Q., Franklin, M., Kran, E., Krawczuk, I., Lamparth, M., Lauffer, N., Meinke, A., Motwani, S., Reuel, A., Conitzer, V., Dennis, M., Gabriel, I., Gleave, A., Hadfield, G., Russell, S., Liu, Y., Wooldridge, M.: Multi-agent risks from advanced AI. arXiv preprint arXiv:2502.14143 (2025). https: //doi.org/10.48550/arXiv.2502.14143 · DOI · Paper page
  20. Hunt, P., Konar, M., Junqueira, F.P., Reed, B.: ZooKeeper: Wait-free co- ordination for internet-scale systems. In: Proceedings of the 2010 USENIX Annual Technical Conference (USENIX ATC). USENIX Association (2010)
  21. Johnson, D., Menezes, A., Vanstone, S.: The elliptic curve digital signature algorithm (ECDSA). International Journal of Information Security 1(1), 36-63 (2001). https://doi.org/10.1007/s102070100002 · DOI
  22. Ménétrey, J., Göttel, C., Khurshid, A., Pasin, M., Felber, P., Schiavoni, V., Raza, S.: Attestation mechanisms for trusted execution environments demystified. In: Proceedings of the 22nd International Conference on Dis- tributed Applications and Interoperable Systems (DAIS). LNCS, vol. 13272, pp. 95-113. Springer (2022). https://doi.org/10.1007/978-3-031- 16092-9_7 · DOI · Paper page
  23. Muid, M.R.A., Chung, T., Hoang, T.: AccuRevoke: Enhancing certificate revocation with distributed cryptographic accumulators. In: Proceedings of the 46th IEEE Symposium on Security and Privacy (S&P). IEEE (2025)
  24. Rose, S., Borchert, O., Mitchell, S., Connelly, S.: Zero trust architecture. Special publication 800-207, National Institute of Standards and Technology (NIST) (2020). https://doi.org/10.6028/NIST.SP.800-207 · DOI · Paper page
  25. South, T., Marro, S., Hardjono, T., Mahari, R., Whitney, C., Chan, A., Pentland, A.: Position: AI agents need authenticated delegation. In: Pro- ceedings of the 42nd International Conference on Machine Learning (ICML) (2025), position Paper Track (Oral)

Cited by

Sorted by citations

Authors
Deochake, S.
Affiliations
American Sentinel University (US)
Corresponding author
Deochake, Saurabh
ORCID
Deochake, Saurabh
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2605.20704
arXiv
2605.20704
OpenAlex
W7162023451
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
Keywords
credential revocation, cryptographic authentication, OCSP, LLM agent security, prompt injection, secure enclaves, clock skew

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review