Sentinel: Confidential AI-Powered Airport Congestion Management with TEE-Enforced Computer Vision + Video

By /

Listen to this Post

Featured Image

Introduction

Modern aviation hubs face a persistent paradox: passenger volumes continue to rise, yet terminal infrastructure remains largely static. Traditional approaches to congestion management rely on reactive measures—opening additional security lanes after queues form, or dispatching staff to bottleneck points only after delays are already apparent. Sentinel, developed by a team of NUS students during VietJet Air’s enterprise challenge at Agentic Build Week 2026 in Ho Chi Minh City, reimagines this paradigm. By combining computer vision for real-time passenger flow analytics with confidential computing via the Terminal 3 Agent Dev Kit (T3 ADK), Sentinel processes sensitive surveillance data inside hardware-enforced Trusted Execution Environments (TEEs)—ensuring that congestion predictions and operational recommendations are generated without exposing personally identifiable information to the host operating system or cloud infrastructure. This article dissects the architectural decisions, implementation steps, and security implications of building AI agents that are both operationally intelligent and cryptographically private.

Learning Objectives

  • Understand how confidential computing, specifically Intel TDX enclaves, protects AI inference pipelines processing sensitive video feeds in airport environments.
  • Learn to deploy a computer vision-based congestion detection model using YOLOv8 or RetinaNet within a TEE using the Terminal 3 Agent Dev Kit (T3 ADK).
  • Implement authenticated sessions and post-quantum encrypted channels (ML-KEM) between edge cameras, AI agents, and enterprise dashboards.
  • Explore hybrid architectures combining GPU-accelerated inference with CPU-based TEEs for privacy-preserving AI at scale.

You Should Know

1. Architecture Overview: Computer Vision Meets Confidential Computing

Sentinel’s architecture rests on three foundational pillars: computer vision for real-time passenger density estimation, agentic AI for predictive congestion modeling, and confidential computing for end-to-end data privacy.

Computer Vision Layer: The system ingests feeds from existing airport security cameras and applies object detection models—YOLOv8 or RetinaNet—to count passengers, estimate queue lengths, and identify congestion hotspots. These models are optimized for near-real-time inference, balancing accuracy against latency in high-traffic terminal environments.

Agentic AI Layer: The vision-derived metrics feed into an AI agent that predicts congestion patterns 15–30 minutes in advance. This agent uses historical flow data, flight schedules, and real-time occupancy to recommend dynamic resource allocation—opening additional screening lanes, rerouting passenger flows, or adjusting staffing levels.

Confidential Computing Layer: The Terminal 3 Network (T3N) provides a decentralized cluster of nodes running inside hardware TEEs—specifically Intel TDX (Trust Domain Extensions) enclaves. All sensitive computation occurs within these enclaves; video frames are decrypted only inside enclave memory and are never exposed to the host operating system. The T3 Agent Dev Kit (ADK) simplifies building agent tenant applications on this network, handling authenticated sessions via Ethereum wallet signatures and establishing post-quantum encrypted channels using ML-KEM.

Data Flow:

  1. Edge cameras capture video → frames are encrypted before transmission.
  2. Encrypted frames arrive at the T3N node → decrypted only inside the TDX enclave.
  3. YOLOv8/RetinaNet inference runs inside the enclave → passenger counts and flow metrics generated.
  4. Agent logic (also inside the enclave) processes metrics → congestion predictions and recommendations produced.
  5. Outputs are signed with the enclave’s attestation → verifiable by any stakeholder.
  6. Recommendations are delivered to airport operations dashboards via authenticated, encrypted channels.

  7. Setting Up the Terminal 3 Agent Dev Kit (T3 ADK) Environment

Before deploying any AI workload, you must configure the T3 ADK and establish a connection to the T3 Network. The ADK is a client SDK that allows developers to build agent tenant applications on T3N.

Prerequisites:

  • Node.js (v18 or higher) and npm installed.
  • An Ethereum wallet (e.g., MetaMask) for authentication.
  • Access to a T3N node (or a local TEE simulator for development).

Step-by-Step Setup:

1. Install the T3 ADK package:

npm install -g @terminal3/agent-devkit

2. Initialize a new agent project:

t3 agent init my-airport-agent
cd my-airport-agent
  1. Configure the T3N connection: Create a `.env` file with your wallet private key and the T3N node endpoint: 
    T3N_NODE_URL=https://t3n.terminal3.io
WALLET_PRIVATE_KEY=your_private_key_here

  2. Authenticate and open an encrypted channel: The ADK handles this in one call—it signs in with your Ethereum wallet and opens an encrypted channel to the TEE node.

    const { T3Agent } = require('@terminal3/agent-devkit');
const agent = new T3Agent({
nodeUrl: process.env.T3N_NODE_URL,
wallet: process.env.WALLET_PRIVATE_KEY
});
await agent.authenticate();

  3. Verify the enclave attestation: Before sending any sensitive data, verify that the TEE node is genuine and running the expected software:

    const attestation = await agent.getAttestation();
console.log('Enclave measurement:', attestation.measurement);
// Compare against known-good measurement from your deployment pipeline

  4. Deploying a Computer Vision Model Inside a TEE

The core challenge is running YOLOv8 or RetinaNet inference inside an Intel TDX enclave—an environment with limited memory and no GPU acceleration by default. The T3N architecture addresses this by supporting heterogeneous confidential computing, where GPUs are integrated into the trusted execution environment.

Option A: CPU-Only Inference (for development/small-scale)

  • Use ONNX Runtime or TensorFlow Lite with CPU-optimized models.
  • Quantize the model to INT8 to reduce memory footprint.
  • Expected latency: 200–500ms per frame (depending on model size).

Option B: GPU-Accelerated Inference (for production)

  • Deploy on Alibaba Cloud gn8v-tee instances or similar that integrate GPUs into the TEE.
  • Use NVIDIA’s confidential computing capabilities to protect data during transmission between CPU and GPU, and during computation within the GPU.

Step-by-Step: Deploying YOLOv8 Inside a TEE

1. Export the model to ONNX format:

from ultralytics import YOLO
model = YOLO('yolov8n.pt')
model.export(format='onnx', imgsz=640)
  1. Encrypt the model weights before uploading to the T3N storage network: 
    t3 storage encrypt yolov8n.onnx --output yolov8n.encrypted

  2. Write the inference script to run inside the enclave (this code executes within the TEE):

    import onnxruntime as ort
import numpy as np
from PIL import Image

Decrypt model inside enclave (handled by T3N SDK)
model_bytes = t3_storage.decrypt('yolov8n.encrypted')
session = ort.InferenceSession(model_bytes)</p></li>
</ol>

<p>def infer(frame_bytes):
image = Image.open(io.BytesIO(frame_bytes))
image = image.resize((640, 640))
input_tensor = np.array(image).astype(np.float32) / 255.0
input_tensor = np.expand_dims(input_tensor, axis=0).transpose(0, 3, 1, 2)
outputs = session.run(None, {'images': input_tensor})
return outputs[bash]  Detection results

    4. Deploy the agent to the T3N:

    t3 agent deploy my-airport-agent --enclave-type tdx
    1. Invoke the agent with an encrypted video frame: 
      const frameBuffer = fs.readFileSync('frame.jpg');
const encryptedFrame = await agent.encrypt(frameBuffer);
const result = await agent.invoke('process_frame', { frame: encryptedFrame });
console.log('Detections:', result.detections);

    4. Implementing Authenticated Sessions and Post-Quantum Encryption

    All communication between the agent and external systems—cameras, dashboards, third-party APIs—must be authenticated and encrypted. The T3N SDK provides built-in support for ML-KEM (post-quantum key encapsulation) and Ethereum wallet-based authentication.

    Authentication Flow:

    1. The client (e.g., an airport operations dashboard) signs a challenge with its Ethereum wallet private key.
    2. The T3N node verifies the signature against the wallet’s public address.
    3. Upon successful verification, a session is established with a post-quantum secure channel using ML-KEM.

    Implementation Example:

    // Client-side authentication
const { ethers } = require('ethers');
const wallet = new ethers.Wallet(process.env.WALLET_PRIVATE_KEY);

async function authenticateWithT3N() {
const challenge = await fetch(<code>${T3N_URL}/challenge</code>).then(r => r.json());
const signature = await wallet.signMessage(challenge.message);
const response = await fetch(<code>${T3N_URL}/authenticate</code>, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ address: wallet.address, signature, challengeId: challenge.id })
});
const session = await response.json();
return session.token; // Use this token for subsequent requests
}

    Encrypting Sensitive Payloads:

    // Using the T3N SDK's session layer (ML-KEM encrypted)
const session = await agent.createSession(targetAddress);
const encryptedPayload = await session.encrypt(JSON.stringify({
cameraId: 'T2-GATE-15',
timestamp: Date.now(),
frame: base64Frame
}));
await session.send(encryptedPayload);

    5. Security Considerations and Remote Attestation

    The security model of Sentinel hinges on remote attestation—the ability for any stakeholder to verify that the AI agent is running inside a genuine TEE and that the code executed matches the expected version.

    Why This Matters:

    • Airport operators must trust that passenger flow data is not being leaked to unauthorized parties.
    • The airline (VietJet Air) needs assurance that congestion predictions are not manipulated.
    • Passengers have a right to privacy—their images should not be stored or transmitted in plaintext.

    Verifying Attestation Reports:

    // Fetch the attestation report from the TEE node
const report = await agent.getAttestationReport();

// Verify the report against the expected measurement
const expectedMeasurement = '0xabcd1234...'; // Known-good hash from your CI/CD
if (report.measurement !== expectedMeasurement) {
throw new Error('Attestation failed: enclave measurement mismatch');
}

// Verify the report's signature (using Intel's public key)
const isValid = verifyAttestationSignature(report);
if (!isValid) {
throw new Error('Attestation failed: invalid signature');
}

    Best Practices for Production Deployments:

    • Pin the enclave measurement in your client application—do not accept arbitrary attestations.
    • Rotate wallet keys regularly and use hardware wallets for production.
    • Implement rate limiting on the agent to prevent denial-of-service attacks.
    • Log all attestation failures and alert operations teams immediately.
    • Use separate TEEs for different airport terminals to limit blast radius in case of compromise.
    1. Windows and Linux Commands for TEE-Enabled AI Deployment

    Linux (Ubuntu 22.04) – Setting Up a TEE Development Environment:

     Install Docker and necessary dependencies
sudo apt update && sudo apt install -y docker.io docker-compose

Install the T3 CLI
npm install -g @terminal3/agent-devkit

Verify TDX support (if running on a TDX-enabled instance)
cat /proc/cpuinfo | grep -i tdx

Run a local TEE simulator for development
docker run -p 8080:8080 terminal3/tee-simulator:latest

Deploy the agent
t3 agent deploy --enclave-type tdx --endpoint http://localhost:8080

    Windows (PowerShell) – Connecting to T3N from a Windows Client:

     Install Node.js and npm (if not already installed)
winget install OpenJS.NodeJS

Install the T3 ADK globally
npm install -g @terminal3/agent-devkit

Set environment variables
$env:T3N_NODE_URL = "https://t3n.terminal3.io"
$env:WALLET_PRIVATE_KEY = "your_private_key"

Initialize an agent project
t3 agent init my-windows-agent
cd my-windows-agent

Test the connection
t3 agent status
    1. Mitigating AI-Specific Threats: Model Extraction and Adversarial Attacks

    Deploying AI models in airport environments introduces unique threats beyond traditional cybersecurity concerns.

    Model Extraction Attacks: An adversary with API access could query the model repeatedly to reconstruct its weights or decision boundaries. Confidential computing mitigates this by keeping the model weights encrypted at rest and decrypted only inside the TEE—the attacker never sees the raw model.

    Adversarial Examples: Subtle perturbations to video frames could cause misclassification (e.g., failing to detect a crowded area). Mitigation strategies include:
    – Input sanitization: Normalize and preprocess all frames before inference.
    – Ensemble methods: Run inference with multiple models and compare outputs.
    – Adversarial training: Include adversarial examples in the training dataset.

    Implementation Snippet – Input Sanitization Inside the TEE:

    def sanitize_frame(frame_bytes):
 Convert to PIL, apply basic denoising, and resize
image = Image.open(io.BytesIO(frame_bytes))
image = image.filter(ImageFilter.MedianFilter(size=3))
image = image.resize((640, 640))
 Check for anomalies (e.g., all-black frames, extreme brightness)
if np.mean(np.array(image)) < 10 or np.mean(np.array(image)) > 245:
raise ValueError("Suspicious frame detected")
return image

    What Undercode Say

    • Confidential computing is no longer optional for AI agents processing sensitive data. The Sentinel project demonstrates that hardware-enforced TEEs can be integrated into real-world hackathon solutions—not just academic research. As AI agents gain access to cameras, microphones, and personal data, the ability to attest that data was processed securely becomes a competitive differentiator.

    • The convergence of computer vision and confidential computing creates a new category of “privacy-preserving physical AI.” Traditional approaches to airport security either sacrifice privacy (by sending video to the cloud) or sacrifice intelligence (by processing only anonymized, low-fidelity data). TEE-enabled edge inference bridges this gap, allowing rich analytics without data exposure.

    • The Terminal 3 ecosystem lowers the barrier to entry for confidential AI development. The ADK abstracts away much of the complexity of enclave programming, remote attestation, and post-quantum cryptography—making it accessible to student developers and hackathon participants. This democratization is critical for accelerating adoption.

    • Enterprise adoption will hinge on standardization and interoperability. While T3N provides a compelling solution, airport operators will demand compatibility with existing security frameworks, SIEM tools, and compliance regimes (e.g., GDPR, PDPA). The industry needs open standards for TEE attestation and cross-platform agent communication.

    • The “agentic” paradigm shifts the attack surface. Traditional security focused on perimeter defense and network segmentation. AI agents, by design, have broad privileges—they call external tools, manage long-term memory, and handle service credentials. Confidential computing addresses runtime data protection, but agent governance and access control remain open challenges.

    Prediction

    • +1 Within 24 months, major airports in Asia-Pacific will pilot TEE-enabled AI congestion management systems, driven by regulatory pressure (PDPA, GDPR) and operational efficiency gains. Singapore’s Changi Airport, with its strong tech infrastructure and proximity to the NUS talent pool, is a likely early adopter.

    • +1 The Terminal 3 Agent Dev Kit will evolve into an industry-standard framework for confidential AI agents, analogous to what Kubernetes became for container orchestration. Its integration with Hedera and other blockchain networks suggests a future where agent actions are auditable on distributed ledgers.

    • -1 The complexity of remote attestation and enclave management will remain a barrier for smaller enterprises and startups. Without managed services that abstract away TEE operations, confidential AI adoption may be limited to well-resourced organizations for the next 3–5 years.

    • -1 As AI agents become more autonomous, the risk of “agent sprawl”—unmonitored, misconfigured agents operating in production—will grow. Enterprises will need new categories of security tools for agent discovery, vulnerability scanning, and behavior monitoring, similar to what EDR provides for endpoints today.

    ▶️ Related Video (88% Match):

    https://www.youtube.com/watch?v=0yIba0__Zx0

    🎯Let’s Practice For Free:

    🎓 Live Courses & Certifications:

    Join Undercode Academy for Verified Certifications

    🚀 Request a Custom Project:

    Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
    [email protected]
    💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

    IT/Security Reporter URL:

    Reported By: https://lnkd.in/p/e5g-nYy2 – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow UndercodeTesting & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: