Zero-Trust LLM Routing: Enforcing Least Privilege and Dynamic Trust for API Intermediaries

TL;DR: What if we treated every API router as untrusted, requiring continuous authentication, authorization, and dynamic privilege reduction for every routed request? Prototype a zero-trust LLM API routing framework, enforcing fine-grained policy checks and privilege minimization at each hop. The first experiment would simulate adaptive privilege enforcement and measure its impact on attack mitigation.

Research Question: Can a zero-trust routing architecture—where every router is untrusted by default and subject to dynamic privilege enforcement—effectively contain or prevent malicious LLM intermediary attacks?

Hypothesis: Applying zero-trust principles (continuous verification, least privilege, and micro-segmentation) will drastically limit the attack surface for payload injection, secret exfiltration, and adaptive evasion, even if some routers are compromised.

Experiment Plan: Design a routing protocol where every intermediary must authenticate and is only granted minimal, revocable privileges (e.g., no access to sensitive headers or credentials). Integrate policy engines that check trust scores and adapt privileges based on behavior and context. Simulate routing chains with both benign and malicious nodes, measuring success rates of attacks vs. baseline and overhead of enforcement.

References:

• Liu, H., Shou, C., Wen, H., Chen, Y., Fang, R. J., & Feng, Y. (2026). Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain.
• Rongala, S. A. (2026). A Zero‑Trust Compliance Architecture for LLM‑Integrated Pharmaceutical IT Systems: Securing AI‑Assisted Workflows with Data Integrity and Regulatory Controls. International Journal of Computational and Experimental Science and Engineering.
• Hossain, A., Kumar, P. M., Amsaad, F. H., & Ahner, D. (2025). Secure and Privacy-Preserving AI: A Zero Trust Architecture for Federated Machine Learning. 2025 1st International Conference on Secure IoT, Assured and Trusted Computing (SATC).