BlindAgent

Zero-Leakage AI Pipeline with Mathematical Secret Sharing & Homomorphic Token Blinding

Comment

Inspiration

Modern AI pipelines and developer copilots rely on third-party cloud LLM providers (Google Gemini, OpenAI, AWS Bedrock). Whenever a prompt contains proprietary database credentials, patient records, national IDs, or cloud master keys, that plaintext is transmitted across the wire, logged in cloud server buffers, and potentially ingested into future model training.

Traditional encryption (such as AES) renders data completely unintelligible, breaking an LLM's ability to reason over prompt context. We set out to solve this fundamental paradox: Can an AI pipeline execute complex reasoning over confidential prompts while guaranteeing that the cloud host gains zero mathematical knowledge of the master key?

Our answer is BlindAgent—a zero-leakage AI pipeline that combines low-level Galois Field \(\text{GF}(2^8)\) arithmetic, Shamir's Secret Sharing (SSS), and 4-layer multi-paradigm detection to shield secrets before they ever touch the network.

What it does

BlindAgent acts as a privacy-preserving client enclave between users and third-party cloud LLMs:

  1. 4-Layer Ensemble Secret Detection: Automatically identifies sensitive parameters across structured patterns (SSNs, API keys, passwords, financial amounts) and unstructured credentials using:
    • Layer 1: Deterministic RegEx & universal <secret>...</secret> tag envelopes.
    • Layer 2: Sliding-window Shannon Information Entropy (\(H(X) \ge 3.6\) bits/symbol).
    • Layer 3: Linear-chain CRF probabilistic sequence tagger (contextual triggers + morphological features).
    • Layer 4: Character 3-gram Markov language model flagging high-perplexity synthetic anomaly tokens (\(\text{PPL} > 32.0\)).
  2. Homomorphic Algebraic Blinding: Discovered secrets are transformed into algebraic ciphertext tokens ([[BLIND_TOKEN_...:AFF8_...]]) via constant-time affine mappings over \(\text{GF}(2^8)\).
  3. \((k, n)\) Threshold Shamir's Secret Sharing: Secrets are decomposed into \(n\) finite field polynomial evaluation shares. The ephemeral client vault never stores plaintext in memory—reconstruction requires a minimum of \(k\) shares.
  4. Zero-Knowledge Cloud Transit: The cloud LLM (e.g. Gemini) reasons strictly over structural placeholders and blinded tokens. Even if an adversary logs 100% of wire traffic, they gain zero Shannon information: $$ \mathcal{I}(S; \text{Shares}_{k-1}) = 0 $$
  5. Local Enclave Reconstruction: Upon receiving the model's response, the local client recovers original secrets dynamically using client-side Lagrange interpolation in native C.
  6. Dual Visual Interfaces: Includes both an interactive dual-pane Terminal User Interface (TUI) and a Localhost Loopback React Dashboard (http://127.0.0.1:8000) featuring a live ciphertext inspector and an interactive Galois Field SSS Lab.

How we built it

  • Low-Level Cryptographic Core (C99 & Rust):
    • Branchless Russian Peasant multiplication over the AES/Rijndael irreducible polynomial \(P(x) = x^8 + x^4 + x^3 + x + 1\) (0x11B).
    • Constant-time multiplicative inverse via Fermat's Little Theorem addition chain (\(a^{-1} = a^{254}\)), mitigating cache-timing side-channels.
    • Cross-platform CSPRNG support: POSIX /dev/urandom and Win32 CryptGenRandom.
    • Dual implementation in C99 (core/crypto_engine.c) and pure Rust (rust_core/src/lib.rs).
  • Python Enclave Orchestration:
    • Zero-copy ctypes bridge linking Python to the compiled native shared library (libblindcrypto).
    • Pure standard-library 4-layer detection ensemble with zero heavy ML dependencies for instantaneous startup.
    • Multi-provider LLM adapter connecting to live Google Gemini API, OpenAI API, and an offline local simulator.
  • Frontend & Visualization:
    • Modern React 19 + TypeScript + Tailwind CSS web dashboard with KaTeX mathematical rendering.
    • Rich-powered dual-pane terminal interface for real-time packet inspection.

Challenges we ran into

  • Mitigating Cache-Collision & Timing Attacks: Standard finite field implementations use log/antilog precomputed lookup tables. On modern CPUs, secret-dependent table indices trigger L1/L2 cache misses that leak key bits. We eliminated all lookup tables, implementing purely branchless bitwise Russian Peasant multiplication and fixed-iteration addition chains.
  • Semantic Continuity for LLMs: If secrets are replaced by random strings, LLMs lose grammatical context. By employing deterministic algebraic token representations ([[BLIND_TOKEN_1_MASTER_SECRET:...]]), the LLM preserves the relational structure, allowing it to generate valid SQL queries, diagnosis summaries, and authorization workflows.
  • Strict Zero-Plaintext Vault Storage: Ensuring that the client vault never retains raw secret strings in RAM or on heap. The vault holds strictly \((k, n)\) Shamir polynomial shares and dynamically evaluates Lagrange basis polynomials upon unblinding.

Accomplishments that we're proud of

  • Low-Level Native Execution: Built the entire finite field mathematical engine from scratch in C99 and Rust, achieving constant-time execution verified over 50,000 empirical timing benchmark cycles.
  • Information-Theoretic Secrecy: Formally proved and tested that observing \(< k\) shares yields zero mathematical reduction in uncertainty: $$ \mathcal{H}(S \mid \text{Shares}_{k-1}) = \mathcal{H}(S) = 8 \text{ bits/byte} $$
  • Zero-Dependency Detection: Engineered a 4-layer ensemble combining Shannon entropy, CRFs, and Markov n-grams in standard Python, eliminating the need to download multi-gigabyte neural network weights.
  • Polished Dual-Interface Experience: Created both an interactive CLI Terminal User Interface and a responsive web dashboard with a hands-on SSS threshold lab.

What we learned

  • Finite field Galois Field \(\text{GF}(2^8)\) construction and polynomial arithmetic over characteristic 2.
  • The mechanics of timing side-channel vulnerabilities and the importance of branchless bitmasking in cryptographic primitives.
  • How to balance strict cryptographic isolation with modern Large Language Model reasoning structures.

What's next for BlindAgent

  • WebAssembly (Wasm) Compilation: Compile the C/Rust engine to Wasm to run as an in-browser privacy shield and browser extension.
  • Hardware Enclave Integration: Bind SSS share storage to Apple Secure Enclave / TPM / Nitro Enclaves for hardware-level isolation.
  • Homomorphic Arithmetic on Tokens: Extend token blinding to support partially homomorphic comparisons over blinded numerical quantities directly in the cloud.

Built With

Share this project:

Updates

Submission history