How to verify an LLM agent's audit log without the decryption key

说明与用途

在不解密日志的情况下验证LLM代理的审计日志完整性，使用哈希链和外部锚点。

问题

Verifying that an LLM agent’s audit log has not been tampered with without decrypting its contents or revealing the decryption key.

结果

The verifier confirms log integrity without decrypting bodies, detects tampering or truncation, and provides exit codes suitable for CI integration.

工作流

• Install Palimpsests via pip and run the demo to generate a deterministic audit log.
• Use palimpsests pala verify <file> to check internal consistency of the log headers and body hashes.
• Extract the head hash from the verification output and supply it as an anchor with --anchor to detect truncation or replacement.
• Tamper with a byte in the log file and rerun verification to see how the tool reports the specific link break.
• Interpret the exit codes: 0 for success, 1 for integrity failure, 2 for incomplete checks.

证据

The verifier walks the headers one by one and compares each body with the digest stored for it. It never decrypts a body, so it never needs the key.

来源

Exit code 0. No key was used at any point.

来源

The log implementation has not been through an independent penetration test yet.

来源