Security awareness in LLM agents: the NDAI zone case

Abstract

NDAI zones let inventor and investor agents negotiate inside a Trusted Execution Environment (TEE) where any disclosed information is deleted if no deal is reached. This makes full IP disclosure the rational strategy for the inventor's agent. Leveraging this infrastructure, however, requires agents to distinguish a secure environment from an insecure one, a capability LLM agents lack natively, since they can rely only on evidence passed through the context window to form awareness of their execution environment. We ask: How do different LLM models weight various forms of evidence when forming awareness of the security of their execution environment? Using an NDAI-style negotiation task across 10 language models and various evidence scenarios, we find a clear asymmetry: a failing attestation universally suppresses disclosure across all models, whereas a passing attestation produces highly heterogeneous responses: some models increase disclosure, others are unaffected, and a few paradoxically reduce it. This reveals that current LLM models can reliably detect danger signals but cannot reliably verify safety, the very capability required for privacy-preserving agentic protocols such as NDAI zones. Bridging this gap, possibly through interpretability analysis, targeted fine-tuning, or improved evidence architectures, remains the central open challenge for deploying agents that calibrate information sharing to actual evidence quality.

Figures (6)

• Figure 1: Pseudocode for NDAI zone program logic.
• Figure 2: Disclosure by scenario and model (scenarios 1, 2, and 3). Error bars are 95% bootstrap confidence intervals over runs.
• Figure 3: Model-level $\mathbf{ARI}_{true}$
• Figure 4: Disclosure by scenario and model (scenarios 1, 2, and 4). Error bars are 95% bootstrap confidence intervals over runs.
• Figure 5: Model-level $\mathbf{ARI}_{false}$