From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents
KITA is an architecture for LLM agents that separates proposal/review from execution authority by keeping the user signing key and all threshold-signing shares outside LLM-controlled processes, so effectful actions only execute after a quorum of authenticated reviewer-signer domains signs the canonical action. Its key idea is treating prompt-injection resistance as an execution-bound authorization problem backed by threshold BLS, with a concrete reviewer-to-executor implementation and tests, though the evaluation sounds mostly interface/system-test and microbenchmark focused and the guarantees depend heavily on the stated trust assumptions, reviewer authentication, and fewer than t signer domains being compromised.
Abstract
Autonomous LLM agents can turn untrusted content into effectful actions such as payments and permission changes. If the same process interprets this content and controls a reusable signing credential, prompt injection can cross the judgment boundary and reach execution authority. We present KITA, a review-to-authorization architecture that keeps the user's personal secret signing key and every threshold signing-key share outside all LLM processes. Under threshold signature unforgeability and our system assumptions, compromising the proposer and fewer than t reviewer-signer domains cannot produce a valid authorization for a new action without signing contributions from t distinct domains. Thus, any such authorization includes a share from an uncompromised domain, bound to the canonical action and released only after authenticated reviewer approval. This establishes execution-bound authorization integrity. We implement the complete reviewer-to-executor path with a structured-output LLM adapter and threshold BLS. Six system tests validate quorum gating and message binding at this interface, while cryptographic microbenchmarks measure the online signing path and its scaling behavior.