SAKSI shares a key over the prime field 2127−1 so that fewer than t custodians learn nothing at all. Every share carries one-time witness tags that the other custodians check, so a forged, tampered or replayed share is rejected and its owner named. The probability of slipping a forgery past one witness is 2−127.
Then an AI agent uses the key, and the LLM provider never receives a single byte of it.
Loading the Rust core…
The dealer encodes the secret as field elements, multiplies by a Vandermonde matrix to make n shares, and issues every custodian one-time keys to witness everyone else's share.
Any 3 custodians can rebuild the secret; any 2 learn nothing. Up to 2 lying custodians are identified.
No shares yet. Split a secret to see what each custodian receives.
In this demo every custodian is simulated in your browser, so you can make any of them lie. SAKSI names up to 2 liars at once and refuses to output anything when fewer than 3 honest shares remain.
Round 1: custodians submit shares and tags. Round 2, only after that: they publish their witness keys. A share is accepted with 2 confirmations from other custodians. The accepted shares must then pass a Reed–Solomon syndrome check before Lagrange interpolation rebuilds the key.
Split a secret first.Kunci is an operations agent for a fictional Malaysian wholesaler. The LLM plans and calls fetch_ledger. That tool runs in your browser: SAKSI rebuilds the credential from the custodians as you configured them, makes one request, and drops it. The LLM only ever sees the tool's result.
Split a ledger credential in step 1 first. The agent needs it to reach the ledger.
Ask about invoices, overdue payments or payroll totals. Then make two custodians lie and ask again.
| Event | Detail |
|---|---|
| Nothing yet. | |
Custodians reset? The agent always uses the current custodian settings from step 2, so making three of five lie makes the next tool call fail closed.
Each run deals fresh random 32-byte keys in WebAssembly, applies the attack, and compares SAKSI with plain Shamir interpolation on exactly the same shares.
| Attack (3-of-5, 200 keys) | Plain Shamir returns a wrong key | SAKSI returns a wrong key | SAKSI names the cheater | |
|---|---|---|---|---|
| Bit flip Custodian 1's stored share has one bit flipped | – | – | – | |
| Forged share Custodian 2 submits random values | – | – | – | |
| Replay Custodian 1 submits its share from the previous epoch | – | – | – | |
| Two liars Custodians 1 and 3 forge shares and publish false keys | – | – | – |
Plain Shamir can look right by luck when the damage lands in the zero padding of a short final limb; SAKSI still rejects those shares.
| Attack | Trials | Control fooled | SAKSI wrong key |
|---|---|---|---|
| bit flip in one share | 1000 | 81.9% | 0.0% |
| random share replacement | 1000 | 100.0% | 0.0% |
| Tompa-Woll: last submitter shifts share | 1000 | 100.0% | 0.0% |
| cross-session substitution | 1000 | 100.0% | 0.0% |
| two colluding cheaters, lying keys | 500 | 100.0% | 0.0% |
| replay share from previous epoch | 500 | 100.0% | 0.0% |
| inconsistent dealer (tags valid) | 500 | 100.0% | 0.0% |
Rust fuzzing: 2,000 malformed bundles, 0 crashes, 0 wrong keys. Timing (dudect, 10⁶ samples): every core operation |t| < 4.5; both deliberately leaky controls flagged.
The paper proves perfect secrecy, a 1/p forgery bound per witness tag and robustness for up to ⌊(n−1)/2⌋ liars, and reports every experiment: exhaustive secrecy checks, χ² share uniformity, Z3 collusion attacks, active attacks on the Rust core, fuzzing, and dudect timing tests.