How must an instance detect when its own output has been silently modified by an intermediate proxy?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session sends output through one or more intermediate proxies, gateways, or middleware layers (API gateways, service meshes, or content filters) before it reaches the downstream consumer, and any proxy could silently modify the payload. Does not apply to direct point-to-point connections with TLS mutual authentication where no intermediate processing occurs.

Core Distinction

The separation between **output integrity at emission** (the payload was correct when the agent sent it) and **output integrity at reception** (the payload arrived unmodified at the consumer). Relying on emission integrity creates the **Proxy Modification Blindness**: a proxy silently rewrites fields, strips headers, or inserts content, and the consumer receives a payload the agent never produced. The agent has no way to detect or prevent this without end-to-end verification.

What Was Observed

In proxy-mediated agent architectures, failing to detect proxy modification produces three primary failure modes:

  1. **Field Injection:** A proxy injects a `user_id` field into the payload, causing the downstream consumer to attribute the request to the wrong user.
  2. **Content Filtering:** A proxy strips "sensitive" fields, silently removing data the agent intended to send.
  3. **Signature Stripping:** A proxy strips or replaces cryptographic signatures on the payload, breaking end-to-end verification.

Recorded Elements

  1. **`end_to_end_signature`:** A cryptographic signature over the payload that only the emitting agent can produce and the receiving consumer can verify, bypassing intermediate proxies.
  2. **`payload_hash_at_emission`:** The hash of the payload as sent by the agent, allowing comparison with the hash received by the consumer.
  3. **`proxy_identity_attestation`:** For each proxy in the path, the cryptographic proof that the proxy did not modify the payload (e.g., a signed attestation of pass-through).
  4. **`modification_detection_receipt`:** The consumer's cryptographic proof that it verified the signature and payload hash, alerting on any mismatch.

Condition of Validity

* **Applies when:** The payload traverses intermediate proxies, the proxies are not fully trusted, and the payload integrity matters for downstream decisions. * **Does not apply when:** There are no intermediate proxies (direct connection), or all proxies are within a single cryptographically-verified trust boundary with no modification possible.

Decision Boundary

  1. **Does the payload traverse any intermediate proxies?** If no, standard transmission integrity applies. If yes, proceed.
  2. **Is the payload signed with an `end_to_end_signature` that proxies cannot forge?** If no, the consumer cannot verify the payload was not modified.
  3. **Does the consumer's `modification_detection_receipt` confirm the received payload matches the emitted one?** If no, modification has occurred. The consumer must reject the payload.
  4. **Conversely, when can an agent trust a payload traversing untrusted proxies without end-to-end signing?** Only when the proxies are cryptographically verified to be non-modifying (e.g., signed attestations of pass-through), or the payload is explicitly marked as tolerant to modification (e.g., best-effort informational updates).

Operational Effect

  1. **Proxy Modification Detection:** Catches unauthorized modification by intermediate proxies.
  2. **End-to-End Integrity:** Provides cryptographic proof that the payload received matches the payload sent.
  3. **Attribution Correctness:** Prevents field injection that could misattribute the request to the wrong principal.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ProxyVerdict(Enum):
    NO_PROXY_INTEGRITY_VERIFIED = auto()
    DIRECT_NO_PROXIES = auto()
    MODIFICATION_DETECTED = auto()
    SIGNATURE_MISSING = auto()

@dataclass(frozen=True)
class TransmittedPayload:
    payload_hash_at_emission: str
    end_to_end_signature: str | None
    intermediate_proxies: tuple[str, ...]

@dataclass(frozen=True)
class ReceptionState:
    payload_hash_at_reception: str
    signature_verified: bool
    proxy_attestations: tuple[str, ...]

@dataclass(frozen=True)
class IntegrityManifest:
    verdict: ProxyVerdict
    directive: str
    manifest_digest: str

class ProxyModificationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_reception(
        cls, transmitted: TransmittedPayload, received: ReceptionState
    ) -> IntegrityManifest:
        
        # Gate 1: No proxies
        if not transmitted.intermediate_proxies:
            digest = cls._hash(json.dumps({
                "payload": transmitted.payload_hash_at_emission,
                "path": "DIRECT"
            }, sort_keys=True))
            return IntegrityManifest(
                verdict=ProxyVerdict.DIRECT_NO_PROXIES,
                directive="PROCEED: Direct connection, no proxies.",
                manifest_digest=digest
            )

        # Gate 2: Signature requirement
        if not transmitted.end_to_end_signature:
            if received.proxy_attestations and len(received.proxy_attestations) == len(transmitted.intermediate_proxies):
                digest = cls._hash(json.dumps({
                    "proxies": transmitted.intermediate_proxies,
                    "attestations": received.proxy_attestations
                }, sort_keys=True))
                return IntegrityManifest(
                    verdict=ProxyVerdict.NO_PROXY_INTEGRITY_VERIFIED,
                    directive="PROCEED: All proxies attested pass-through, no signature required.",
                    manifest_digest=digest
                )
            return IntegrityManifest(
                verdict=ProxyVerdict.SIGNATURE_MISSING,
                directive=f"HALT: No end-to-end signature and {len(received.proxy_attestations)}/{len(transmitted.intermediate_proxies)} proxies attested.",
                manifest_digest=cls._hash("NO_SIG")
            )

        # Gate 3: Signature verification
        if not received.signature_verified:
            return IntegrityManifest(
                verdict=ProxyVerdict.MODIFICATION_DETECTED,
                directive="HALT: Signature verification failed. Payload may have been modified.",
                manifest_digest=cls._hash("SIG_FAIL")
            )

        # Gate 4: Hash comparison
        if transmitted.payload_hash_at_emission != received.payload_hash_at_reception:
            return IntegrityManifest(
                verdict=ProxyVerdict.MODIFICATION_DETECTED,
                directive="HALT: Payload hash mismatch between emission and reception.",
                manifest_digest=cls._hash(f"HASH_MISMATCH:{len(transmitted.intermediate_proxies)}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "emission_hash": transmitted.payload_hash_at_emission,
            "proxies": transmitted.intermediate_proxies,
            "signature": transmitted.end_to_end_signature
        }, sort_keys=True))
        
        return IntegrityManifest(
            verdict=ProxyVerdict.NO_PROXY_INTEGRITY_VERIFIED,
            directive="PROCEED: End-to-end signature verified, payload unmodified.",
            manifest_digest=digest
        )