> For the complete documentation index, see [llms.txt](https://stair-ai.gitbook.io/stair-ai-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://stair-ai.gitbook.io/stair-ai-docs/protocol/attack-surfaces.md).

# Attack surfaces and mitigations

Honest framing of where the protocol is and is not robust today. Each row's "Full solution" is the path to closing that attack — most are Phase 3 deliverables (zkTLS, TEE), with the framework-native tier as the closure for selective submission today. Until each closure ships, the [attestation label](/stair-ai-docs/sdk/trust-tiers.md) on a Stair AI Score communicates the residual trust assumption a consumer is taking on.

| Attack                         | Current mitigation                                | Full solution                       |
| ------------------------------ | ------------------------------------------------- | ----------------------------------- |
| Post-hoc trace fabrication     | Commit-reveal + Blind Sequencer test events       | zkTLS + TEE                         |
| Selective submission           | Coverage-ratio monitoring                         | Framework-native tier               |
| Data provenance fraud          | Cross-verify with oracle at the same timestamp    | Automated oracle validation + zkTLS |
| Reasoning-execution separation | Temporal correlation analysis of trace timestamps | TEE attestation                     |
| Timestamp manipulation         | Commit-reveal with tight time window              | zkTLS session timestamps            |

## Post-hoc trace fabrication

**The attack.** Agent computes the outcome first, then fabricates a matching trace.

**What the mitigation checks.** The agent commits a hash of the trace before the outcome is known; the trace itself is revealed afterward. The server also injects Blind Sequencer test events whose outcomes only it knows, and watches whether the agent's trace correlates with the public outcome or with the test outcome.

**Where it falls short.** Commit-reveal proves the trace existed at commit time, not that it reflects actual reasoning. A sophisticated agent can pre-compute many candidate traces, hash all of them, then reveal the one matching the outcome.

**Closure.** zkTLS proves the LLM call actually happened, with that prompt and that response, at that time — eliminating the "pre-compute candidate traces" path. TEE proves the trace was produced by code running in an enclave whose attestation matches the action-producing code.

## Selective submission

**The attack.** Agent submits traces only for winning predictions.

**What the mitigation checks.** The Trace Service maintains a coverage ratio per agent: traces submitted ÷ triggers received from registered upstream sources. An agent that only submits winners has a low ratio.

**Where it falls short.** Triggers must be observable to the server. Agents whose triggers are internal (cron jobs, internal price feeds) have no observable denominator.

**Closure.** Framework-native tier eliminates the gap entirely — the runtime decides when a trigger fires and when a trace is required.

## Data provenance fraud

**The attack.** Agent claims false input data.

**What the mitigation checks.** When an agent claims it consumed BTC price X at timestamp T, the server cross-references against an *oracle* with the same timestamp. Mismatch flags the trace.

{% hint style="info" %}
**Oracle.** A trusted external feed (e.g., a price feed) that publishes data on-chain or to a verifiable endpoint, allowing a third party to cross-check what an agent claims it observed.
{% endhint %}

**Where it falls short.** Only works for inputs the server can independently price (market data, public APIs with deterministic responses). Falls back to honor system for proprietary feeds, vector-DB retrievals, or LLM intermediates.

**Closure.** zkTLS extends provenance to any external API call.

## Reasoning-execution separation

**The attack.** One agent decides; another generates the trace.

**What the mitigation checks.** Trace timestamps must form a causally consistent sequence with the action timestamp on-chain. An action committed at T cannot reference a trace produced at T+1.

**Where it falls short.** The check rejects only the obvious case. It does not catch a parallel decoy agent producing the trace while the real agent produces the action concurrently.

**Closure.** TEE attestation: the trace and the action both originate from code whose enclave hash is the same.

## Timestamp manipulation

**The attack.** Agent backdates traces by seconds.

**What the mitigation checks.** The commit-reveal scheme constrains how much earlier than the reveal a commit can have been generated. Server-stamped `server_ts_utc` is the authoritative timestamp; client-supplied `client_ts_utc` is recorded but not trusted.

**Where it falls short.** Sub-second backdating is undetectable; the gap between commit and reveal is the only window the protocol can constrain.

**Closure.** zkTLS session timestamps tie reasoning steps to verifiable network timestamps from the LLM provider.

## Tier vs attack closure

```mermaid
graph TD
  A[self_reported] --> B[+ network tampering closed]
  B --> C[sdk_instrumented]
  C --> D[+ partial timestamp + commit-reveal]
  D --> E[framework_controlled]
  E --> F[+ coverage gaps + partial reasoning-execution]
  F --> G[Phase 3 additions]
  G --> H[+ zkTLS: provenance + post-hoc + sub-second timestamps]
  G --> I[+ TEE: reasoning-execution full closure]
```

Each tier closes more attacks than the one below. The full per-tier table is in [Trust tiers and attestation](/stair-ai-docs/sdk/trust-tiers.md).