# Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms

arXiv: https://arxiv.org/abs/2605.20704 · HTML: https://mlsanity.com/paper/2605.20704/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 34 references that are in the map.
- First posted on arXiv 20 May 2026.

## Builds on (most cited first, 10 of 10)

- [Concrete Problems in AI Safety](https://mlsanity.com/paper/1606.06565/) (2016)
- [Multi-Agent Risks from Advanced AI](https://mlsanity.com/paper/2502.14143/) (2025)
- [Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast](https://mlsanity.com/paper/2402.08567/) (2024)
- [AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathways](https://mlsanity.com/paper/2406.02630/) (2024)
- [The Ethics of Advanced AI Assistants](https://mlsanity.com/paper/2404.16244/) (2024)
- [AI Agents with Decentralized Identifiers and Verifiable Credentials](https://mlsanity.com/paper/2511.02841/) (2025)
- [Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents](https://mlsanity.com/paper/2509.13597/) (2025)
- [Attestation Mechanisms for Trusted Execution Environments Demystified](https://mlsanity.com/paper/2206.03780/) (2022)
- [Identity and Access Management Framework for Multi-tenant Resources in Hybrid Cloud Computing](https://mlsanity.com/paper/2203.11463/) (2022)
- [A Multi-Cloud Framework for Zero-Trust Workload Authentication](https://mlsanity.com/paper/2510.16067/) (2025)

## Built on by (most cited first, 3 of 3)

- [Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution](https://mlsanity.com/paper/2609.21284/) (2026)
- [Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback](https://mlsanity.com/paper/2610.00347/) (2026)
- [Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways](https://mlsanity.com/paper/2610.15991/) (2026)

## Abstract (arXiv)

Autonomous AI agents that spawn sub-agent swarms create a safety gap: existing credential revocation mechanisms, OAuth~2.0 introspection, OCSP, and W3C Status Lists, require network connectivity to a central authority, leaving ``zombie agents'' executing privileged operations for minutes to hours after operator shutdown. We present Heartbeat-Bound Hierarchical Credentials (HBHC), a cryptographic protocol that binds credential validity to periodic parent liveness proofs. Verifiers enforce freshness using only a cached public key and local clock; no network round-trip is required. When heartbeat generation ceases, all descendant credentials become unusable within a deterministically bounded window Wz ≤ Wmax + Deltah + ε, conditional on bounded clock skew and parent keys held in secure enclaves. Evaluation at the protocol layer and with real LLM-backed agent swarms (GPT-4o-mini) demonstrates a 90× reduction in the zombie window over OAuth~2.0, 0.26~ms full authentication in Rust, 18,000+ verifications per second under concurrent HTTP load, and stable per-verification latency from 10 to 10,000 agents. Real-agent experiments show 0.71% end-to-end overhead on tool calls, zero post-revocation tool calls under prompt injection that bypasses application-layer guardrails, and cascading revocation across a 49-agent four-level hierarchy within the theoretical bound.