PaperlayerView exact revision on arXiv

Source-linked AI summary

Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains

Toqeer Ali Syed, Asadullah Abdullah Khan

arXiv:2609.31282v1cs.CRcs.AI

TL;DR

Software supply chains face attacks across development and deployment, while autonomous security agents also raise questions about the integrity of their actions. This paper combines specialized LLM-enabled agents with signed blockchain attestations and release-policy checks; it reports improved detection and verification efficiency and the blocking of insecure builds.

  • Problem

    Software supply chains face lifecycle-wide attacks, and the literature identifies a gap in autonomous, self-adaptive real-time protection as agentic systems raise trust and integrity questions.

    Source: INTRODUCTION · p. 2, LITERATURE REVIEW · p. 6

  • Method

    The framework orchestrates specialized LLM-enabled security agents and anchors their signed findings on a permissioned blockchain for release-policy evaluation.

    Source: INTRODUCTION · p. 2, Architecture Overview · p. 10

  • Results

    The paper reports a 38% increase in vulnerability detection, a 39% reduction in verification time, and 23 insecure builds blocked by blockchain-based release policies.

    Source: Summary of Findings · p. 22

  • Takeaways & Limitations

    The framework provides a unified architecture for securing both the software supply chain and the agentic AI ecosystem through decentralized attestation and CA-secured communication.

    Source: INTRODUCTION · p. 2

    Blockchain immutability does not prevent all insider threats, particularly privileged key misuse.

    Source: DISCUSSION · p. 24

Abstract

from arXiv · show

This paper proposes a blockchain-backed agentic security framework designed to safeguard the complete software development lifecycle (SDLC) while also securing the agentic AI components responsible for monitoring it. The framework coordinates a set of specialised security agents, covering source integrity, dependency and SBOM analysis, CI configura tion auditing, artifact verification, and runtime policy evaluation, each supported by a large language model (LLM) that interprets artefacts, reasons over tool outputs, and produces structured security reports. To ensure agent trustworthiness, every agent generates a cryptographically signed attestation that is recorded in a permissioned blockchain via smart contracts, including an agent registry, an immutable attestation log, and an enforceable release-policy module. Communication among agents and with blockchain nodes is secured using a consortium-operated certificate authority, ensuring authenticated and tamper-resistant interactions. A detailed use-case and sequence flow demonstrate how a source code security agent performs analysis, anchors its attestation on-chain, and triggers a verifiable allow/block deployment decision. The proposed framework of fers decentralised integrity transparent provenance, uninterrupted security assurance and a generalisable architecture to incorporate the agentic AI into the modern software supply chain security.

INTRODUCTION

Modern software supply chains face growing, lifecycle-wide attack surfaces, while agentic security systems raise questions about the trustworthiness of their own assessments. The paper proposes a blockchain-backed framework that secures both the supply chain and its agents through signed attestations and verifiable release decisions.

INTRODUCTION

  • The distributed ecosystem of repositories, dependencies, build pipelines, registries, and deployments gives adversaries opportunities to target software throughout its lifecycle.The paper notes that breaches such as SolarWinds targeted development rather than only deployed systems, and argues detection alone is no longer sufficient.Source: INTRODUCTION · p. 2
  • LLM-enabled agents can analyze repositories, SBOMs, CI configurations, signatures, and misconfigurations, but their actions and assessments must also be trusted.The paper identifies risks from malicious instructions propagating through agent messages and tool-mediated workflows.Source: INTRODUCTION · p. 2
  • The framework deploys specialized LLM-supported agents across the lifecycle, with each agent signing findings that a permissioned blockchain records for release-policy evaluation.The release-policy smart contract uses the attestations to determine whether a build should be trusted for deployment.Source: INTRODUCTION · p. 2
  • The architecture secures both software supply chains and agentic AI through decentralized attestations, consensus-backed state, and CA-secured communication.A source-code agent use case traces repository analysis, an LLM-supported risk assessment, on-chain evidence anchoring, and a verifiable release decision; the framework is intended to operate continuously across the SDLC.Source: INTRODUCTION · pp. 2–3

BACKGROUND

The background describes supply-chain vulnerabilities and agentic AI, then presents reinforcement learning as a route to adaptive defense. Together, agentic reasoning and RL are framed as a basis for self-defensive software ecosystems.

Software Supply Chain and Its Vulnerabilities

  • Development pipelines expose multiple attack surfaces, and compromised components can propagate downstream as signed, apparently valid artifacts.Traditional analysis and provenance approaches are described as largely reactive and lacking autonomy against dynamic attacks such as injection and misconfigured pipelines.Source: Software Supply Chain and Its… · pp. 3–4

Agentic Artificial Intelligence

  • Agentic AI uses autonomous agents that perceive environments, reason about context, and act on security targets, with cybersecurity agents tracking repositories and build pipelines.The paper also describes these agents as capable of self-directed and explainable defense.Source: Agentic Artificial Intelligence · p. 4

Reinforcement Learning for Autonomous Defense

  • Reinforcement learning models agent-environment interaction as an MDP and seeks an optimal policy that maximizes cumulative reward.In CI/CD settings, repeated interaction is presented as a way for agents to derive defensive strategies and reduce false positives.Source: Reinforcement Learning for Autonomous… · pp. 4–5

Integration of RL and Agentic Systems in Supply Chain Defense

  • Combining agentic cognition with RL-based adaptive decision-making is presented as a path toward self-defensive software that can detect and address vulnerabilities in real time.Multi-agent collaboration, shared knowledge representation, and reinforcement-based learning are associated with scalable, explainable, and resilient defense.Source: Integration of RL and Agentic Systems… · pp. 5–6

LITERATURE REVIEW

Prior work has advanced provenance and workflow automation, but the review identifies gaps in autonomous, adaptive protection across software supply chains.

Prior approaches

  • Earlier work spans secure-design concepts, SBOM and attestation workflows, attack taxonomies, provenance enforcement, and agent coordination, with limitations including fixed policies or no pipeline-specific defense.The review also describes ARGO-SLSA as deterministic and agentic-AI studies as not designed for software development pipelines.Source: LITERATURE REVIEW · p. 6

Industrial and emerging work

  • Industrial AI-remediation prototypes are described, but the review says they lack peer-reviewed knowledge, reproducible evaluation information, and open-source structures.The literature review characterizes agentic or reinforcement-based learning in defensive mechanisms as little explored.Source: LITERATURE REVIEW · p. 7

Research gaps

  • The review identifies three gaps: limited proactive safeguards during development, weak autonomy over heterogeneous evidence and evolving threats, and no direct defenses against several dynamic vulnerability classes.Examples include injection, insecure deserialization, broken access control, and CI/CD configuration drift.Source: LITERATURE REVIEW · pp. 6, 8

AttestChain

  • AttestChain combines multi-agent security analysis with cryptographically verifiable attestations and on-chain release-policy enforcement, treating agents as verifiable entities.The paper presents this as a response to the identified gaps.Source: LITERATURE REVIEW · p. 8

PROPOSED FRAMEWORK: BLOCKCHAIN-BACKED AGENTIC SECURITY FOR THE SOFTWARE SUPPLY CHAIN

The proposed framework combines LLM-supported security agents across SDLC layers with permissioned-blockchain attestations and release-policy enforcement.

PROPOSED FRAMEWORK: BLOCKCHAIN-BACKED AGENTIC SECURITY FOR THE SOFTWARE SUPPLY CHAIN

  • The framework monitors the SDLC and agent integrity through LLM-supported security components, blockchain-backed attestations, smart-contract release policies, and CA-protected communication.The paper describes the framework as covering the complete software supply-chain lifecycle.Source: PROPOSED FRAMEWORK: BLOCKCHAIN-BACKED… · p. 9

Architecture Overview

  • Specialized agents analyze distinct SDLC stages, while an orchestrator maintains build state and the LLM plans and interprets tool calls rather than directly modifying systems.Tools include static analyzers, SBOM generators, vulnerability scanners, and log or configuration APIs.Source: Architecture Overview · p. 10

Trust, Attestation, and Agent Security

Agent Workflows and Algorithms

  • A generic agent retrieves layer-specific artifacts, iterates between LLM reasoning and tool calls, and returns a structured report with issues, severity, risk score, and status.The workflow submits the report for hashing, signing, and on-chain attestation.Source: Agent Workflows and Algorithms · pp. 12–13
  • The attestation algorithm verifies agent authorization, hashes and signs a payload, and submits it to AttestationLog; release evaluation checks mandatory layers, signatures, statuses, and risk.The controller queries on-chain state to decide whether to proceed or block deployment.Source: Agent Workflows and Algorithms · pp. 13–14

Use-Case: Source Code Security Agent and Attesta tion Flow

  • In the source-agent use case, CI/CD triggers repository analysis and static checks; a signed report is recorded on-chain before the policy contract returns a deployment decision.The framework is described as instantiable for dependencies, CI configuration, artifact signing, and runtime policy enforcement.Source: Use-Case: Source Code Security Agent… · pp. 15–16, Figure 5 · p. 15

IMPLEMENTATION

The prototype combines tool-enabled LLM agents, LangGraph coordination, and a permissioned blockchain for attestations and release-policy enforcement.

IMPLEMENTATION

  • The prototype integrates LangChain for tool-enabled LLM reasoning, LangGraph for multi-agent orchestration, and a lightweight permissioned blockchain, implemented in Python.The paper says it can be reproduced using standard open-source packages.Source: IMPLEMENTATION · p. 16

Environment Setup

  • The environment uses Python 3.10 with LangChain, LangGraph, an OpenAI or cloud LLM API, Web3.py or a ledger emulator, and Pydantic.Agents receive unique key pairs and CA-signed certificates for mutual TLS; the permissioned chain may be emulated by an in-memory ledger.Source: Environment Setup · p. 16

Agent Architecture

  • Each agent combines external tools, a task-specific prompt, and LLM reasoning; structured tool outputs are interpreted into Pydantic reports for consistency across layers.Example tools include static analyzers, dependency scanners, and configuration validators.Source: Agent Architecture · pp. 16–17

Multi-Agent Coordination via LangGraph

  • LangGraph passes shared build state across agent and system nodes, which may execute sequentially or in parallel according to dependencies.The described graph includes source analysis, attestation, and policy evaluation nodes.Source: Multi-Agent Coordination via LangGraph · p. 17
  • Coordination is layer-scoped and write-once: agents append reports only for their own layers, a barrier waits for required statuses, and duplicate reports use FAIL ≻ WARN ≻ OK ≻ MISSING dominance.The policy contract computes the auditable release decision from the effective statuses.Source: Multi-Agent Coordination via LangGraph · p. 17

Attestation and Blockchain Integration

  • The attestation client hashes serialized reports, signs payloads containing build, agent, layer, status, risk, and time, and submits them to the immutable log; consortium confirmation takes hundreds of milliseconds to a few seconds.PoA or BFT-style consensus is assumed; formal verification of the minimal deterministic contracts is outside the work’s scope.Source: Attestation and Blockchain Integration · p. 18

Executable Flow: End-to-End Multi-Agent Pipeline

  • The end-to-end flow carries a CI/CD build request through source-agent analysis and blockchain anchoring to a verifiable allow/block signal, which the authors say provides independently verifiable agents.The ReleasePolicy contract evaluates attestations before the pipeline proceeds.Source: Executable Flow: End-to-End… · p. 19

RESULTS AND EVALUATION

Across a simulated supply chain, the agentic framework improved detection coverage and verification speed, while blockchain-backed policy enforcement blocked insecure releases. The reported findings also include zero false attestations.

Detection Coverage Across Supply Chain Layers

  • About 38% higher detection coverage than conventional scanners came from identifying semantic vulnerabilities they often miss.Figure 6 covers findings across five SDLC layers; traditional scanners performed well on syntactic problems such as linter violations.Source: Detection Coverage Across Supply Chain… · p. 19, Figure 6 · p. 20

Reduction in Verification Time

  • 39% lower end-to-end verification time was reported for the agentic system relative to traditional automated scanning.The framework had the shortest analysis time per build, with parallel, orchestrated agent analysis contributing to the reduction.Source: Reduction in Verification Time · p. 20, Figure 7 · p. 21

Integrity and Policy Compliance Assurance

Summary of Findings

  • The reported summary includes zero false attestations, with each agent cryptographically bound to its identity and producing immutable on-chain evidence.The experiments compared manual review, conventional automated scanners, and LLM-based multi-agent analysis with blockchain-supported attestations.Source: RESULTS AND EVALUATION · p. 19, Summary of Findings · p. 22
  • The framework’s reported improvements span detection coverage, verification time, and provenance assurance.The authors characterize these as measurable improvements in supply-chain security, operational efficiency, and trustworthiness.Source: Summary of Findings · p. 22

THREAT MODEL

The threat model covers attacks on supply-chain stages and monitoring agents, while assuming the permissioned blockchain and cryptographic foundations remain secure.

Trust Assumptions

  • The model assumes the permissioned blockchain follows its configured consensus protocol and that most validators behave honestly.Consensus compromise and collusion by a majority of validators are out of scope.Source: THREAT MODEL · p. 22
  • Secure key management is assumed for agents and validators; private-key leakage or misuse is treated as a general infrastructure risk.The model also presupposes secure consensus, secure storage of agent keys, and uncompromised SHA-256 or ECDSA.Source: THREAT MODEL · pp. 22–23

Threats in Scope

  • The model includes code tampering, build-system manipulation, agent targeting, evidence suppression or alteration, and supply-chain poisoning.Examples include malicious code or dependencies, bypassed security checks, counterfeit agent reports, altered release evidence, and compromised container images.Source: THREAT MODEL · p. 22

EVALUATION SETUP

The evaluation used a controlled, synthetic software supply chain and compared three security-review settings across 500 builds with injected vulnerabilities.

Evaluation Setup

  • The controlled supply chain comprised a Git repository, dependency manifest, CI pipeline, container build, and emulated Kubernetes deployment.The repository had 200+ commits, the manifest contained 48 libraries, and the GitHub Actions pipeline had 14 workflow steps.Source: EVALUATION SETUP · p. 23

Agent Deployment

  • Five source, dependency, CI, artifact, and runtime agents used an LLM alongside static and semantic analysis tools.The agents produced structured reports for attestation and evaluation.Source: EVALUATION SETUP · p. 23

Blockchain Attestation Layer

  • A permissioned ledger used AgentRegistry, AttestationLog, and ReleasePolicy contracts to register identities, store attestations, and enforce build gates.The contracts respectively manage trusted agent identities, immutable attestations, and evidence-based release rules.Source: EVALUATION SETUP · p. 23

Synthetic Workload and Vulnerability Injection

  • The workload comprised 500 synthetic builds with vulnerabilities injected across SDLC layers, with one to three issues per build.All builds were analyzed under identical conditions; evaluated metrics included detection coverage, verification time, blocked releases, and missing or invalid attestations.Source: EVALUATION SETUP · pp. 23–24

DISCUSSION

The discussion attributes detection gains to contextual reasoning over heterogeneous artifacts and faster verification to parallel layer-specific analysis. It also identifies query overhead, model and prompt dependence, and privileged key misuse as limitations.

Results Interpretation

  • Reasoning across source code, commit histories, dependency graphs, and CI configurations helps agents identify semantic risks traditional scanners typically miss.The multi-agent architecture also reduces verification time by parallelizing layer-specific analysis.Source: DISCUSSION · p. 24

Trust and Provenance

  • Blockchain-backed attestations make historical records resistant to forgery or deletion and tie agent impersonation to possession of a registered keypair.This addresses mutable logs and security decisions in centralized CI/CD systems.Source: DISCUSSION · p. 24

Limitations

  • LLM-query overhead remains, although parallelization partially offsets it; agent reasoning quality depends on prompt design and model capabilities.Blockchain immutability does not prevent all insider threats, particularly privileged key misuse.Source: DISCUSSION · p. 24

CONCLUSION

The framework combines LLM-enabled reasoning, multi-agent orchestration, and decentralised attestation to secure the software supply chain, with reported gains in vulnerability coverage and verification speed. It also frames verifiable agent evidence as a broader trustworthy-autonomy paradigm and identifies scaling, runtime monitoring, and adaptive-agent attestations as future work.

CONCLUSION

  • Vulnerability detection coverage improves by 38%, verification time falls by 39%, and insecure releases that bypass conventional tooling are prevented.The framework combines LLM-enabled reasoning, multi-agent orchestration, and decentralised attestation.Source: CONCLUSION · p. 24
  • Verifiable, immutable, and auditable evidence of agent actions is presented as a general paradigm for trustworthy autonomous systems.The paper argues such frameworks will be essential as software ecosystems become more interconnected and AI-driven automation more pervasive.Source: CONCLUSION · p. 24
  • Future work will scale the architecture across distributed development organisations, add runtime behavioural monitoring, and extend attestations to generative and adaptive agents.Source: CONCLUSION · p. 25

Related papers

Loading 2609.31282v1…