{"slug":"five-signed-receipt-protocols-no-shared-trust-model","citations":[{"url":"https://arxiv.org/abs/2606.04193","committed_hash":"sha256:1cc7d493410bd275821d226419356e1accdac2041d0cdb745db046c4502d9fc7","committed_hash_short":"sha256:1cc7d493…502d9fc7","mime_type":"text/html","committed_at":"2026-08-06T00:00:19.702520+00:00","content_snapshot":"\n\n\n [2606.04193] Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n \n \n \n \n\n\n
\n Skip to main content\n \n \n \n
\n \n\n \n \"archive\"\n \n\n \n\n \n
\n\n\n
\n
\n
\n\n
\n
\n

Computer Science > Cryptography and Security

\n
\n\n
\n arXiv:2606.04193 (cs)\n
\n\n
\n
\n
\n [Submitted on 2 Jun 2026]
\n

Title:Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions

\n
Authors:Juan Figuera
\n View PDF\n HTML (experimental)\n\n\n\n
\n Abstract:Current AI agent observability is structurally compromised: the entity producing the activity log is the same entity whose activity is being logged. A compromised or buggy agent can omit, alter, or fabricate its own traces, and the operator running the agent has no independent way to detect tampering. We propose a class of protocols that resolves this by inverting the trust boundary: the service that receives an agent's call signs a receipt of what it observed using its own key, encrypts the receipt to the agent's owner, and publishes it to a public transparency log. The owner reconstructs a tamper-evident trail without trusting the agent or its operator. We instantiate the class as Sello, a protocol combining four properties absent in any current system: (P1) receiver-side signing, (P2) HPKE encryption to an owner public key bound to the authorization token via JWS, (P3) publication to a witness-cosigned Merkle log, and (P4) owner-side discovery by token reference. We describe the protocol, analyze its security under an adversary that controls the agent and its operator, present microbenchmarks of the cryptographic operations, and situate Sello among adjacent receipt-protocol work (Signet, AgentROA, Agent Passport System, draft-farley-acta, SCITT). We discuss known limitations including the suppression attack, service collusion, and the adoption-incentive problem.\n
\n\n \n
\n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n
Comments:22 pages. Reference implementation at this https URL
Subjects:\n Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Distributed, Parallel, and Cluster Computing (cs.DC)
Cite as:arXiv:2606.04193 [cs.CR]
 (or \n arXiv:2606.04193v1 [cs.CR] for this version)\n
  https://doi.org/10.48550/arXiv.2606.04193
\n \n \n
\n arXiv-issued DOI via DataCite
\n
\n
\n
\n
\n
\n
\n

Submission history

From: Juan Figuera [view email]
[v1]\n Tue, 2 Jun 2026 20:21:58 UTC (25 KB)
\n
\n
\n \n
\n \n Full-text links:\n

Access Paper:

\n \n
\n \"license\n view license\n
\n
\n
\n

Current browse context:

\n
cs.CR
\n\n
\n\n < prev\n \n   |   \n next >\n
\n
\n new\n | \n recent\n | 2026-06\n
\n Change to browse by:\n
\n cs
\n cs.AI
\n cs.DC
\n
\n
\n\n
\n
\n

References & Citations

\n \n
\n
\n\n
\n \n \n
\n\n
\n

Bookmark

\n \"BibSonomy\"/\n \n \n \"Reddit\"/\n \n
\n \n\n
\n
\n \n
\n

Bibliographic and Citation Tools

\n
\n
\n
\n \n
\n
\n Bibliographic Explorer (What is the Explorer?)\n
\n
\n
\n
\n \n
\n
\n Connected Papers (What is Connected Papers?)\n
\n
\n
\n \n
\n
\n Litmaps (What is Litmaps?)\n
\n
\n
\n
\n \n
\n
\n scite Smart Citations (What are Smart Citations?)\n
\n
\n
\n
\n
\n
\n
\n
\n\n\n \n \n
\n

Code, Data and Media Associated with this Article

\n
\n
\n
\n \n
\n
\n alphaXiv (What is alphaXiv?)\n
\n
\n\n
\n
\n \n
\n
\n CatalyzeX Code Finder for Papers (What is CatalyzeX?)\n
\n
\n\n
\n
\n \n
\n
\n DagsHub (What is DagsHub?)\n
\n
\n \n
\n
\n \n
\n
\n Gotit.pub (What is GotitPub?)\n
\n
\n\n
\n
\n \n
\n
\n Hugging Face (What is Huggingface?)\n
\n
\n\n
\n
\n \n
\n
\n ScienceCast (What is ScienceCast?)\n
\n
\n
\n\n
\n
\n
\n
\n
\n
\n
\n\n\n \n \n
\n

Demos

\n
\n
\n
\n \n
\n
\n Replicate (What is Replicate?)\n
\n
\n
\n
\n \n
\n
\n Hugging Face Spaces (What is Spaces?)\n
\n
\n
\n
\n \n
\n
\n TXYZ.AI (What is TXYZ.AI?)\n
\n
\n
\n
\n
\n
\n
\n \n \n
\n

Recommenders and Search Tools

\n
\n
\n
\n \n
\n
\n Influence Flower (What are Influence Flowers?)\n
\n
\n
\n
\n \n
\n
\n CORE Recommender (What is CORE?)\n
\n
\n
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n\n \n \n
\n
\n
\n

arXivLabs: experimental projects with community collaborators

\n

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

\n

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

\n

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

\n
\n
\n

\n
\n
\n
\n\n
\n
\n\n
\n Which authors of this paper are endorsers? |\n Disable MathJax (What is MathJax?)\n \n
\n \n
\n
\n
\n\n
\n\n \n\n\n\n","snapshot_chars":41969,"live_check":"matches"}]}