Newest papers

KNOX: Hardware-assisted Regulatory Sandbox for Generative Models

Vasisht Duddu, Adam Caulfield, Xi He · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27543 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

規制は、規制のサンドボックスでAIモデルを実行することを要求しています、規制のサンドボックスで、規制当局によるモデル行動の監視を可能にする孤立した環境です。しかし、彼らは、そのようなサンドボックスを設計するための技術的メカニズムを明確にしない。理想的には、規制サンドボックスは、(i)コンプライアンス(規制に対するチェック、および許可されていないツールおよびシステムの呼び出しによる偏差)を示すべきです。 (ii)プライバシー(規制当局からモデルの重量を保護する)、(iii)実行証明性(モニタリングのためのモデル行動のバッテリー抵抗的な証拠を生成する)と(iv)スケーラビリティ(規

Machine translation (Meta M2M100); the English original follows.

Abstract

Regulations require companies to run AI models in a regulatory sandbox, an isolated environment that enables monitoring model behavior by regulators, prior to deployment. But, they do not spell out the technical mechanisms to design such a sandbox. Ideally, a regulatory sandbox should show (i) compliance (checks against regulations, and deviations from intended behavior, i.e., unauthorized tool and system calls); (ii) confidentiality (protects model weights from regulators); (iii) attestability (produces tamper-resistant evidence of model behavior for monitoring); and (iv) scalability (evidence is verifiable by multiple regulators). Several prior works (information-flow control, prompt-injection defenses, control-flow integrity, and traditional sandboxing) address specific compliance aspects but lack confidentiality, attestability, and scalability. TEEs meet some of these requirements, but simply running models inside a TEE is insufficient as we need compliance mechanisms. We present KNOX, the first regulatory sandbox, built by running AI workloads inside TEEs. We demonstrate KNOX using agentic workloads. For compliance, we derive an attested policy manifest (with the applicable regulations, the expected tool calls, and the permitted system calls) for a given user prompt. Before an executor performs an action, an attested reference monitor compares it against the attested policy manifest and allows it only if it matches. Every action and verdict is recorded in an attested execution graph, enabling regulators to verify the model's execution and its compliance. We show that KNOX meets all requirements, and can check for compliance with regulations and deviations from intended behavior (e.g., due to prompt injection); and incurs low overhead (<1%).

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Sandbox (software development), Computer science, Executor, Scalability, Overhead (engineering), Computer security

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange