AgenTEE: Executing Confidential LLM Agents on Edge Devices

The researchers propose AgenTEE, which uses independently attested confidential virtual machines based on Arm CCA to isolate the LLM agent runtime, inference engine, and third-party applications. Each component runs in a separately attested cVM and interacts through explicit and verifiable communication channels to protect system prompts, model weights, and runtime state. Evaluation shows that this multi-cVM system incurs less than 5.15% runtime overhead compared with multi-process deployment on a commercial OS, approaching native performance.