[SECURITY] Inference results are not cryptographically signed — no tamper-proof verification

[h-network]

Problem Statement

NemoClaw routes inference requests through OpenShell to NVIDIA NIM endpoints or local models. The results are returned over TLS, but there is no application-level cryptographic verification that:

1. The result came from the intended model
2. The result was not modified in transit (beyond TLS)
3. The result was not replayed from a previous request

Impact

In a multi-agent or multi-hop architecture:

• A compromised proxy could modify inference results before they reach the agent
• Results could be replayed to cause repeated actions
• There is no cryptographic proof that a specific model produced a specific output

Proposed Design

Implement HMAC-SHA256 signing on inference results:

import hmac, hashlib, json, time

def sign_result(result: dict, secret: bytes) -> dict:
    result["timestamp"] = time.time()
    payload = json.dumps(result, sort_keys=True).encode()
    result["hmac"] = hmac.new(secret, payload, hashlib.sha256).hexdigest()
    return result

def verify_result(result: dict, secret: bytes) -> bool:
    received_hmac = result.pop("hmac")
    payload = json.dumps(result, sort_keys=True).encode()
    expected = hmac.new(secret, payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(received_hmac, expected)

This provides:

• Origin verification (only holders of the secret can sign)
• Tamper detection (any modification invalidates the signature)
• Replay protection (timestamp + nonce)

References

• Standard practice in API security (AWS Signature V4, Stripe webhooks)
• Particularly important for agentic systems where results trigger real-world actions

Alternatives Considered

No response

Category

enhancement: feature

Checklist

• I searched existing issues and this is not a duplicate
• This is a design proposal, not a "please build this" request

[wscurran]

✨ Thanks for submitting this suggestion with a detailed analysis, it addresses a security concern that could improve the trustworthiness of the inference results, which could make NemoClaw more secure.

---

Possibly related open PRs:
#177 fix(security): add checksum verification for external binary downloads,
#871 security: enforce process limit to prevent fork bombs in sandbox,
#870 feat(security): add prompt injection scanner module