KNOX: Hardware-assisted Regulatory Sandbox for Generative Models

What it is

KNOX (Duddu, Caulfield and He, Vector Institute and University of Waterloo, arXiv 2610.27543v1, 20 October 2026) is a prototype regulatory sandbox for agentic LLM workloads. The authors derive its requirements from the EU AI Act (Articles 57 and 78): compliance, confidentiality of model weights from regulators, attestability, and scalability to multi-task and multi-agent runs. The paper says its code will be public only upon publication.

How it works

The design uses a planner and an executor. The planner turns the user prompt into an attested policy manifest (APM). The manifest holds the applicable regulations (the paper's examples are GDPR and HIPAA), the expected tool-call trajectory, the authorized system calls, paths and limits, and stop conditions such as timeouts.

An attested reference monitor (AttRM) mediates each executor tool call. It converts the call into a five-element tuple and checks it against four guards in the manifest:

• a regulation guard, evaluated by a fixed judge model that reasons over the regulation text;
• a trajectory guard;
• a system-call guard;
• a stop guard, which tests run state.

The verdict is ALLOW or BLOCK. Each action and verdict is written to an attested execution graph (AEG). Nodes carry a measurement and a commit sequence number, linked by a hash chain, with a structure root over the graph topology. The model weights are bound as weights_hash. The attestation signature is produced inside the TD, so several verifiers can check the evidence independently.

flowchart LR
    P[User prompt] --> PL[Planner]
    PL --> APM[Attested policy manifest]
    EX[Executor action] --> RM{AttRM vs guards}
    APM --> RM
    RM -->|match| A[ALLOW]
    RM -->|deviation| B[BLOCK]
    A --> G[Attested execution graph]
    B --> G
    G --> V[Regulators verify]

Preconditions / Affected

• The host OS and hypervisor are untrusted. The agent's control logic runs in an Intel TDX trust domain, and LLM inference runs in an NVIDIA H100 GPU TEE.
• Verifiers must trust Intel and NVIDIA attestation keys.
• The planner and executor are assumed to be standard open-weight models from trusted public sources.
• The adversary can only manipulate external sources the executor reads, which is the prompt-injection model. Physical attacks are out of scope.

What to do

The page gives no commands or deployment steps. The evaluation covers single and multi-task and single and multi-agent settings, including user interrupts. It reports that KNOX flags regulatory non-compliance and unauthorized tool and system calls, with attestation overhead under 1%. The fetched text is cut off before the evaluation section, so the benchmarks, models and attack suites are not visible.

Caveats

• The paper's own comparison table says prior work covers control-flow violations but overlooks data-flow integrity. It mentions that tool calls can run as intended while the data passed to them differs. The visible text does not show whether KNOX checks tool arguments beyond the action tuple.
• Regulation checking depends on a judge model reading regulation text, so its accuracy bounds that guard. The visible text gives no accuracy figures.
• "First regulatory sandbox" is the authors' claim.