Confidentiality and Integrity

Confidentiality — who can see the data?

The most familiar property, and what most people mean by "secure."

Confidentiality means data is unobservable by parties who should not observe it. The mechanisms are encryption in transit and at rest, hardware enclaves that encrypt memory so the machine's own operator cannot read it, and techniques that allow computation over data without ever decrypting it.

The useful question is never "is it confidential?" It is: confidential from whom, and at which moment?

Confidentiality of what, exactly?

In an agent system there are at least four distinct things you might want confidential:

The user's input. Your email contents, travel dates, medical history. Confidential from the network, certainly. From the model provider? From the cloud host? Separate questions, and most systems protect the first and not the others.

The model's weights. If you deployed a proprietary model to a customer's infrastructure, you would prefer they not extract it.

The intermediate reasoning. The chain of thought, retrieved context, the scratchpad. Often overlooked, and often the most sensitive material — it contains fragments of everything the agent has read, concentrated in one place.

The fact that a computation happened at all. Sometimes the metadata is the secret. That a particular company queried a particular legal database at a particular hour may reveal more than the query.

Encryption protects contents. It does not hide sizes, timings, or access patterns.

An observer who cannot read a single byte of your traffic can still see how much there is, when it happened, and where it went. In many settings that is enough.

Integrity — did the computation happen correctly?

A completely different question: was the computation performed as specified, on the inputs claimed, without tampering?

You send a request to an inference provider asking for a response from a large, expensive model. What actually comes back?

You cannot tell. The output looks plausible either way. The provider has an obvious financial incentive to serve you a smaller, cheaper model — and absent some verification mechanism, no way for you to detect it.

That is an integrity failure. It has nothing to do with confidentiality.

The mechanisms are quite different:

Cryptographic proofs — mathematical evidence that a specific computation produced a specific output
Economic guarantees — a bond forfeited if the computation is shown to be wrong
Hardware attestation — a signed statement from a chip about what code it is running

A worked contrast

Scenario one. You send an encrypted query. The server decrypts it inside a hardware enclave, runs the model, encrypts the answer, returns it. Nobody outside the enclave saw your data.

Was the right model used? You have no idea.

Confidentiality: yes. Integrity: no.

Scenario two. You send a plaintext query. The server runs the model and returns the answer with a cryptographic proof that this exact model produced this exact output.

Did anyone see your query? Everyone did.

Integrity: yes. Confidentiality: no.

Two systems. Opposite properties. Both could be described as "verified and secure" by a sufficiently relaxed marketing department.

You cannot get both by accident. You design for both, usually with two different mechanisms.

Key takeaways

Confidentiality has four separate targets in an agent system: inputs, weights, reasoning traces, and metadata.
Encryption protects contents, not sizes, timings, or access patterns.
Integrity failures are undetectable by inspection. A cheaper model returns plausible output.
Confidentiality and integrity are orthogonal. Having one tells you nothing about the other.