Scope boundary

Owns byte-preserving, provider-route-bound, conversation-bound round-trip integrity for signed, encrypted, redacted, or opaque reasoning blocks required for continuation. It rejects client-supplied, reordered, altered, stale, or cross-provider blocks.

AID-H-037.001: AID-H-037.003 preserves provider-authored continuation blocks without alteration; AID-H-037.001 governs display, ordinary logging, approved summaries, and raw-trace storage. Continuity integrity does not authorize exposing or retaining the block's reasoning content.

AID-H-033.005: AID-H-037.003 binds a continuation block to the same provider route and conversation; AID-H-033.005 resolves and enforces the provider, account, model, deployment, endpoint, and route. The block verifier consumes the effective route decision rather than choosing it.

Implementation guidance

• AID-H-037.003-G001: Preserve provider-authored reasoning blocks byte-for-byte, verify provider binding where supported, and reject client-supplied or altered blocks before continuation.

AID-H-037.003-G001

Preserve provider reasoning blocks exactly when round-trip is required

# File: reasoning_security/round_trip_integrity.py
from __future__ import annotations

import hashlib
import hmac
from typing import Callable


VerifyProviderSignature = Callable[[bytes, bytes, str, str], bool]


def assert_provider_block_unchanged(
    *, original_bytes: bytes, returned_bytes: bytes, signature: bytes,
    provider: str, key_id: str, verify_signature: VerifyProviderSignature,
) -> dict:
    if not original_bytes or not signature or not provider or not key_id:
        raise ValueError("provider block, signature, provider, and key ID are required")
    original_sha256 = hashlib.sha256(original_bytes).digest()
    returned_sha256 = hashlib.sha256(returned_bytes).digest()
    if not hmac.compare_digest(original_sha256, returned_sha256):
        raise PermissionError("provider_reasoning_block_modified")
    if not verify_signature(original_bytes, signature, provider, key_id):
        raise PermissionError("provider_reasoning_block_signature_invalid")
    return {
        "provider": provider,
        "key_id": key_id,
        "block_sha256": original_sha256.hex(),
        "byte_length": len(original_bytes),
        "outcome": "PASS",
    }

Complete round-trip verification

Keep blocks server-side and bind digest to provider, route, account, model, conversation, block type, key metadata, policy, and expiry. Never reconstruct signed blocks from parsed JSON. Compare exact bytes in constant time and verify provider authentication or signature under the current API contract. Test cross-provider, cross-conversation, reordering, duplication, stale and revoked-key cases, unknown schema, and verifier failure; independently read back the bytes sent to the provider.

Open-source tools

• pyca/cryptography
• OpenAI Python SDK
• Anthropic Python SDK
• Google Gen AI Python SDK

Commercial / hosted tools

• OpenAI Responses API
• Anthropic Claude API
• Google Gemini API

Threat mappings

MITRE ATLAS

• AML.T0051 LLM Prompt Injection

MAESTRO

• Input Validation Attacks (L3)

OWASP LLM Top 10 2026

• LLM01:2026 Prompt Injection

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• ASI01:2026 Agent Goal Hijack

NIST Adversarial Machine Learning 2025

• NISTAML.018 Prompt Injection

Cisco Integrated AI Security and Safety Framework

• AISubtech-4.2.2 Session Boundary Violation (rejects cross-conversation or cross-provider reasoning-block reuse)
• AITech-4.2 Context Boundary Attacks (rejects cross-conversation or cross-provider reasoning-block reuse)
• AITech-7.1 Reasoning Corruption

Google Secure AI Framework 2.0 - Risks

• PIJ: Prompt Injection

Databricks AI Security Framework 3.0

• N/A