On 20 October 2026 three researchers from the Vector Institute and the University of Waterloo posted a preprint describing KNOX, a regulatory sandbox where regulators can monitor generative models before deployment. The authors argue that a trusted execution environment (TEE), a hardware-isolated environment for running code, does not enforce compliance by itself.[1]
For each prompt, a planner model writes a policy manifest of expected tool calls, applicable rules and permitted system calls (requests to the operating system). A reference monitor checks each action against the manifest, blocking mismatches. A judge model rules on data disclosures under the EU's General Data Protection Regulation and the US Health Insurance Portability and Accountability Act. Actions and verdicts enter an execution graph chained by hashes (digital fingerprints), signed inside the TEE and tied to one quote, Intel's hardware-signed attestation report. The authors say regulators can check the record offline, matching weight hashes to the claimed models, without the weights.[1]
The prototype uses an Intel Trust Domain Extensions (TDX) confidential virtual machine, an NVIDIA H100 graphics processing unit (GPU) in confidential-computing mode and open-weight models: Qwen3.5-9B as planner and judge, and Llama-3.1-8B, Gemma-3-12B and Ministral-3-14B as executors. In tests built on the InjecAgent benchmark with simulated tools, the authors report, the monitor blocked 81.8% to 100% of rule-breaking disclosures across executors and allowed 90% to 96% of compliant ones. It also blocked every off-plan tool call prompted by instructions planted in tool outputs. In 100 unauthorized system-call cases, the monitor alone stopped 74% and Linux kernel restrictions (seccomp-BPF and Landlock) the rest. By the authors' measure, excluding the judge model's computation and TEE overhead, the checks and attestations added under 1% to inference time.[1]
The threat model excludes physical attacks; the authors say side channels, leaks through effects such as timing, remain a concern. The judge's accuracy rests on tests, and the quote does not directly cover per-prompt kernel restrictions.[1]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
120ebcf29033101f97f9f0506f478de33f3aa98aab9f5e413c2e966e8ad52ffb
_-_Waterloo,_ON.jpg){kind=link}