Operator-Blind Secret Mediation for AI Agents: A Formal Model and FHE Construction for Credential Derivation on Untrusted Infrastructure
This work formalizes the model and proves computational operator blindness from indistinguishability under chosen-plaintext attack (IND-CPA) security of the FHE scheme, together with conditional capability binding for any secure pseudorandom function/message authentication code (PRF/MAC) instantiation.