CrossGuard: A Zero-Trust Architecture for Privacy-Preserving AI Deployment Across Heterogeneous Multi-Cloud Environments

Abstract

Deploying AI agents across multi-cloud infrastructure creates a fundamental identity problem. Traditional authentication mechanisms such as OIDC, OAuth, and X.509 PKI depend on centralized identity providers. These providers can be compromised, coerced, or manipulated by malicious cloud operators seeking to impersonate agents or revoke their credentials. We present CrossGuard, an architecture that replaces centralized identity management with blockchain-anchored, hardware-attested agent identities. In our design, each agent's identity is cryptographically bound to its Trusted Execution Environment through on-chain attestation records. This binding ensures that no single party, including cloud operators with full infrastructure access, can forge credentials, override legitimate identities, or tamper with the identity registry. The permissioned blockchain provides Byzantine-fault-tolerant consensus over agent registration, preventing malicious entities from corrupting the identity layer. Beyond identity, CrossGuard integrates confidential computing using Intel SGX and AMD SEV-SNP with smart contract-orchestrated federated learning, enabling privacy-preserving AI collaboration across organizational boundaries. A key technical contribution is our cross-TEE attestation protocol, which establishes mutual trust between enclaves from different hardware vendors without requiring a common root of trust. We implement a proof-of-concept on Hyperledger Fabric 2.5 with Flower-based federated learning. Our experimental evaluation shows blockchain coordination overhead of 660 ± 2ms per aggregation round with 20 participants, TEE-induced training slowdown of 45% for SGX and 5% for SEV-SNP, and linear throughput scaling to 50 concurrent agents. We argue this overhead is justified for autonomous, long-running AI agents where human-in-the-loop verification is infeasible. When amortized over agent lifetimes spanning days or weeks, the cost of cryptographic identity guarantees becomes negligible, while the cost of identity compromise in unsupervised systems such as medical diagnosis or financial transactions remains catastrophic. Our security analysis establishes confidentiality, integrity, and availability arguments under an adversary model that includes malicious cloud operators and Byzantine participants.