PQ-MedTrust: A Post-Quantum, Decentralized-Identity Zero-Trust Architecture for Autonomous Clinical Agents at the Internet-of-Medical-Things Edge

1. Introduction

Agentic artificial intelligence—systems in which language-model-driven agents plan, call tools, delegate tasks, and take actions with limited human oversight—is beginning to enter clinical workflows. When such an agent does more than summarize a record and instead issues a command toward an infusion pump, monitor, wearable biosensor, or other Internet-of-Medical-Things (IoMT) endpoint, the security consequences change qualitatively. An identity that can be spoofed, a delegated capability that exceeds its intended scope, or a credential that cannot be revoked promptly can become a patient-safety problem rather than merely an access-control failure.

The identity and access-management (IAM) mechanisms inherited by these agents are a poor fit for this setting. Protocols such as OAuth, OpenID Connect, and SAML were designed primarily for human users or comparatively static machine identities and typically assume coarse-grained, relatively long-lived, single-entity credentials [1]. Autonomous multi-agent systems are instead dynamic, interdependent, and often ephemeral: agents may spawn, delegate authority, interact with other agents and devices, and dissolve on timescales for which session-centric IAM has no natural representation. Recent work has begun to address this mismatch through verifiable agent identities based on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) [1,2,3], and, in healthcare, through agentic Zero-Trust frameworks that continuously re-evaluate agent trustworthiness from identity, behavioral, and contextual signals [4].

Important gaps nevertheless remain. First, neither the healthcare Zero-Trust literature nor the emerging agent-identity literature substantially addresses the transition to post-quantum cryptography. Their identity, credential, and session mechanisms generally remain dependent on classical public-key cryptography. In healthcare, this is relevant well beyond the lifetime of an individual session. Clinical records, genomic information, authorization evidence, and audit trails may retain legal and clinical sensitivity for decades. An adversary that records protected material today and later gains the ability to decrypt stored ciphertext or forge previously trusted signatures can undermine long-term confidentiality and accountability even when no cryptanalytic attack is feasible at the time of capture. This harvest-now-decrypt-later or harvest-now-forge-later concern motivates post-quantum protection of both active credentials and long-lived audit evidence [5,6].

Second, existing approaches leave a gap between trust assessment and cryptographically enforceable response. Healthcare Zero-Trust models can produce a continuously updated trust signal, but the connection from that signal to credential invalidation and distributed enforcement is often left abstract. Conversely, decentralized-identity approaches provide authenticated identity, delegation, and revocation mechanisms but do not ordinarily specify how continuous behavioral evidence should trigger revocation in an autonomous clinical setting. Much of the resulting literature is therefore architectural or conceptual: it demonstrates how the individual mechanisms could be combined, but provides limited implementation-level evidence about the cost of closing the complete identity–trust–revocation loop or about the conditions under which behavioral trust remains discriminative.

PQ-MedTrust addresses these gaps by treating post-quantum identity, continuous trust evaluation, and revocation as a single measurable enforcement path. The novelty lies not in any one mechanism in isolation, but in connecting them and then evaluating the resulting system at two distinct levels. At the systems level, we ask whether post-quantum agent identity and trust-triggered credential revocation can be implemented with practical latency and communication cost at the IoMT edge. At the behavioral-security level, we ask a different question: under what conditions does the trust mechanism actually separate malicious activity from legitimate clinical behavior?

This second question is central to the contribution. Rather than reporting only a favorable operating point, we systematically characterize where behavioral trust succeeds, where adaptive detection becomes limited by the arrival of risk-bearing evidence, and where the assumptions underlying the trust signal cease to provide meaningful separation between adversarial and benign behavior. Accordingly, PQ-MedTrust is evaluated not only under nominal attack and benign scenarios, but also through component ablations, horizon extension, context degradation, held-out parameter selection, parameter sensitivity, and relaxation of the benign-behavior assumptions on which the reported false-positive rates depend. The resulting contribution is therefore both an implemented post-quantum trust-to-revocation architecture and an explicit characterization of its operating and failure boundaries.

The contributions of this work are:

• C1 — A closed post-quantum trust-to-revocation loop. We connect a continuously evaluated quantitative trust state directly to a verifiable identity-revocation substrate. When an agent’s trust falls below the authorization threshold, its credentials are invalidated and a signed status update is propagated to the relevant enforcement points. This closes the gap between healthcare Zero-Trust approaches, which provide a trust signal without a concrete cryptographic enforcement substrate, and decentralized-agent identity approaches, which provide revocation without a continuously evaluated behavioral trigger.
• C2 — A post-quantum, crypto-agile clinical identity stack. DIDs are anchored by hybrid classical/post-quantum keys, while VCs and scoped delegation tokens are protected with post-quantum signatures. Credential artifacts carry explicit algorithm identifiers so that cryptographic parameter sets can be migrated without redefining the underlying agent identity, a property intended to support long-lived and regulated IoMT deployments.
• C3 — An edge-tiered implementation with measured PQC and communication overhead. We implement the identity, authentication, authorization, and revocation paths across a device/edge/cloud architecture and evaluate classical-only, PQC-only, hybrid, and SLH-DSA configurations. The evaluation separates primitive computation, handshake latency, credential and delegation-token size, trust-to-revocation latency, and constrained-link fragmentation, allowing the cost of quantum-safe agent identity to be localized rather than treated as a single aggregate overhead.
• C4 — A unified healthcare-agentic threat model. We combine clinical threats and multi-agent threats with quantum-specific and revocation-integrity threats, including credential forgery, harvest-now-forge-later exposure, hybrid downgrade, and revocation evasion. The model links each threat class to the identity, trust, delegation, monitoring, or revocation layer responsible for its mitigation.
• C5 — A failure-aware characterization of behavioral trust. Rather than treating attack detection as a single headline rate, we identify the mechanisms that produce each result and test the assumptions under which those results remain valid. Large-sample Monte Carlo evaluation, Wilson confidence intervals, paired component ablations, benign-context stress, disjoint calibration and evaluation seeds, horizon extension, one-at-a-time parameter sensitivity, and relaxation of the benign-emission assumption distinguish policy-enforceable violations from inference-based adaptive stealth. The analysis identifies the observation window, context reliability, and behavioral-signal asymmetry as the principal conditions governing when automatic trust-triggered revocation succeeds and when it fails to distinguish adversarial from benign activity.

Section 2 reviews the relevant work. Section 3 presents the architecture, the hardened trust model, the threat model, and the experimental method. Section 4 reports and analyses the measurements. Section 5 positions them against the literature and draws out the design, clinical-safety, and regulatory implications. Section 6 concludes the paper.

2. Related Work

Zero-Trust architecture replaces implicit perimeter trust with continuous, per-request verification [7]. Recent healthcare-specific work extends this principle to autonomous agents by combining identity checks, policy enforcement, behavioral monitoring, and continuous security assessment [4]. Adjacent healthcare-IoT research provides empirical evidence for behavior-aware trust. SecHealth [8] combines behavioral, communication, and contextual trust with rule-based and supervised anomaly detection for simulated healthcare-device populations, while DynaTrust [9] models historical and peer-informed trust through dynamic graphs to defend multi-agent systems against sleeper agents. These studies establish the relevance of continuous behavioral evidence, but their security objects differ from ours: SecHealth addresses device classification and secure exchange, and DynaTrust addresses graph-based agent isolation rather than post-quantum, action-level credential revocation for autonomous clinical agents.

A complementary literature addresses verifiable identity and authorization for autonomous agents. Huang et al. [1] argue that human-centric IAM is poorly matched to dynamic multi-agent systems and propose agent identities based on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) [2,3], together with fine-grained authorization, selective disclosure, capability-aware discovery, and revocation across protocols. More recent systems move this identity substrate toward runtime enforcement. BlockA2A [10] combines DID-oriented identity, context-aware authorization, auditable interactions, and permission revocation in response to multi-agent attacks, while MolTrust [11] provides a deployment-oriented W3C DID/VC infrastructure covering agent identity, authorization, behavioral records, and credential lifecycle management. These systems demonstrate that standards-based agent identity can support operational security controls, but they do not combine post-quantum credentials with quantitative identity–behavior–context trust in a clinical IoMT setting.

Post-quantum agent authorization is addressed more directly by AITH [12], which introduces ML-DSA-protected continuous delegation, boundary enforcement, and push-based revocation for autonomous AI agents. ARIA [13] is particularly close at the identity layer, combining standards-oriented decentralized agent identity, Verifiable Credentials, post-quantum cryptography, authorization scope, credential status, and real-time revocation. The emerging W3C Agent Identity Registry Protocol Community Group [14] similarly considers DID-based identity, VC credentials, lifecycle management, revocation, trust negotiation, and post-quantum requirements. These efforts demonstrate substantial progress toward quantum-safe agent identity and revocation. Their focus, however, is primarily identity, delegation, credential status, and protocol-level authorization; they do not experimentally connect continuous quantitative behavioral and contextual evidence to trust-triggered credential revocation for autonomous clinical agents.

Post-quantum security has also become an active concern in healthcare and IoMT. NIST has standardized ML-KEM, ML-DSA, and SLH-DSA in FIPS 203–205 [5,15,16]. Bibi et al. [17] investigate edge-assisted post-quantum authentication for IoMT entities, demonstrating the feasibility of quantum-safe authentication across device, edge, and service tiers. CITADEL  [18] integrates post-quantum cryptography with distributed healthcare records and privacy-preserving analytics. These studies establish the relevance of PQC in healthcare environments but focus on patients, devices, services, or healthcare data rather than autonomous agents whose authorization state evolves continuously with observed behavior.

The practical cost of standardized PQC depends strongly on the execution and transport platform. Constrained-device studies identify computation, memory, and communication as important deployment bottlenecks  [6,19,20]. Chhetri et al. [21] provide a particularly relevant benchmark by measuring ML-KEM-768 and ML-DSA-65 on an RP2040 Cortex-M0+, where signing latency and memory requirements are substantially greater than on general-purpose CPUs. Their results motivate the edge-offload strategy used in PQ-MedTrust rather than a direct cross-platform performance comparison. The Open Quantum Safe liboqs library [22] provides the post-quantum implementations used in our software testbed.

Communication overhead is equally important during the classical-to-PQC transition. Gómez-Cambronero et al. [23] experimentally compare classical, hybrid, and post-quantum TLS 1.3 handshakes and show that lattice-based key establishment introduces modest computational overhead under favorable network conditions, while enlarged messages increasingly interact with transport and round-trip behavior; broader analyses report similar hybrid migration trade-offs [24]. For identity artifacts, Arakawa [25] shows that ML-DSA-based Verifiable Credentials grow substantially relative to classical alternatives despite comparatively small host-level signing and verification latency. At the constrained-link layer, Sakk et al. [26] quantify the fragmentation and reliability effects of post-quantum exchanges in IoT networks, while Liu et al. [27] examine their energy cost over low-power wireless links. These studies provide the closest empirical comparators for the credential, handshake, constrained-device, and BLE results reported later in Table 6; because their payloads, hardware platforms, libraries, and protocol scopes differ from ours, we use them as contextual benchmarks rather than direct performance rankings.

Taken together, prior work provides nearly all of the individual components required for quantum-safe autonomous-agent security, but they remain separated across different systems. Healthcare Zero-Trust and multi-agent trust research provide continuous behavioral assessment [4,8,9]; DID/VC frameworks provide verifiable identity, authorization, and credential lifecycle management [1,10,11]; AITH and ARIA move agent delegation and revocation toward post-quantum protection [12,13]; and healthcare-IoMT studies demonstrate the feasibility and cost of PQC on distributed and constrained platforms [17,18,19,21]. The remaining gap is therefore not the absence of any single primitive, but the absence of an evaluated system that closes the complete path from post-quantum agent identity and scoped authorization through continuous behavioral trust, threshold crossing, credential revocation, and propagation to enforcement points in a clinical IoMT setting.

To the best of our knowledge, we found no prior reported implementation that jointly combines post-quantum DID/VC-based identity, continuous quantitative behavior- and context-aware trust, and trust-triggered credential revocation for autonomous clinical agents at the IoMT edge while experimentally characterizing both enforcement overhead and the operating limits of the behavioral trust mechanism. PQ-MedTrust addresses this intersection by implementing and measuring the complete trust-to-revocation path and by evaluating not only its nominal operating point but also the conditions under which behavioral separation deteriorates, including observation-window dependence, component ablations, degraded context, parameter sensitivity, and relaxation of benign-behavior assumptions.

3. Proposed Methodology

3.1. System Model

PQ-MedTrust is organized into three deployment tiers and five functional layers. The device tier contains IoMT endpoints fronted by lightweight device-proxy agents that perform local policy enforcement and event-driven trust checks. The edge/fog tier hosts the policy-enforcement gateway, credential-verification offload, key cache, and capability-aware discovery. The cloud/institutional tier hosts the credential issuer, DID registry, trust engine, revocation authority, behavioral analytics, and a tamper-evident audit ledger. Computationally heavier operations are delegated upward so that latency-sensitive enforcement remains close to the device.

Functionally, the architecture consists of: (L1) identity and credentials—DIDs, VCs, hybrid cryptographic keys, capability discovery, and crypto-agility; (L2) authentication and delegation—hybrid session establishment and scoped, time-bound, invocation-bound delegation tokens; (L3) continuous trust evaluation; (L4) policy enforcement and revocation; and (L5) behavior monitoring and a hash-chained, post-quantum-signed audit log. Figure 1 summarizes the deployment architecture and the closed trust-to-revocation workflow. Autonomous clinical agents present DID/VC-based credentials and scoped delegation evidence through the edge policy enforcement point, while behavioral and contextual observations are supplied to the trust engine. The resulting trust state is consulted during authorization; a threshold crossing triggers credential revocation and propagation of signed status information to the enforcement points. The architecture therefore separates latency-sensitive enforcement at the IoMT edge from credential issuance, behavioral analysis, revocation management, and long-lived audit functions at the institutional tier. The figure specifies the design; the testbed of Section 3.5 implements the identity, authentication, and revocation paths across two agent roles and does not exercise multi-agent delegation at population scale.

3.2. Threat Model

PQ-MedTrust considers threats against autonomous clinical agents, IoMT endpoints, edge gateways, and the institutional services that support identity, trust evaluation, and revocation. The protected assets include agent and device identities represented by DIDs and VCs, private cryptographic keys and session secrets, scoped delegation tokens, PHI and clinical commands, the evolving trust state and its behavioral/contextual evidence, credential-status information, and long-lived audit records. The principal attack surfaces are the agent–device, agent–agent, agent–edge, and edge–institutional links, together with the revocation and audit channels. An adversary may therefore attempt identity spoofing, replay, message manipulation, excessive delegation, unauthorized clinical actions, malicious prompt or tool-input injection, Sybil participation, suppression of revocation state, or manipulation of the evidence used by the trust engine.

The model includes both cryptographic and behavioral adversaries. A network adversary may observe, record, replay, delay, or modify traffic, while a compromised but still validly credentialed agent may remain within its nominal authorization scope and alter its behavior gradually to avoid detection. This distinction motivates continuous trust evaluation: successful credential verification establishes identity but does not guarantee that subsequent agent behavior remains safe. We also consider a future quantum-capable adversary that may attempt to forge classically protected identities or delegation evidence and may retain encrypted traffic for later cryptanalysis. Hybrid classical/post-quantum authentication, ML-KEM-based key establishment, post-quantum signatures, scoped delegation, behavioral monitoring, and signed revocation state jointly address these threat classes.

Table 1 summarizes the resulting threats and their primary mitigations. Explicit policy violations such as out-of-scope actions are treated as directly enforceable security failures, whereas adaptive in-scope behavior requires inference from behavioral and contextual evidence. The latter is therefore a conditional security mechanism rather than a cryptographic guarantee, and the experimental evaluation explicitly tests the conditions under which that evidence remains discriminative. The present model assumes that the credential issuer, root trust material, and cryptographic implementations are initially trustworthy; full compromise of these institutional trust anchors and availability-only attacks such as resource exhaustion or radio jamming are outside the evaluated scope.

3.3. Cryptographic Instantiation

PQ-MedTrust evaluates classical-only, post-quantum, and hybrid cryptographic configurations. The post-quantum configuration uses ML-KEM-768 for key establishment and ML-DSA-65 for signatures, while X25519 and Ed25519 provide the corresponding classical mechanisms. The hybrid configuration combines the classical and post-quantum components so that authentication requires both signature components and session-key establishment incorporates both classical and post-quantum contributions. ML-KEM-768 and ML-DSA-65 target NIST security category 3. SLH-DSA-SHA2-128f is evaluated separately for infrequent, long-lived signatures such as audit records because its substantially larger signature makes it unsuitable for routine per-action use. Credentials carry explicit algorithm identifiers to support cryptographic migration without redefining the underlying agent identity.

3.4. Trust Model

Each agent a maintains a scalar trust state $T_a\left(t\right)\in (0,1]$ that is consulted at every authorization decision. Trust is governed by an evidence ceiling ${\overline{T}}_a\left(t\right)$, which reflects currently observable identity, behavioral, and contextual evidence, and a risk-dependent attenuation that preserves the effect of adverse events.

Following and extending the healthcare Zero-Trust formulation of [4], the evidence ceiling is

$${\overline{T}}_a\left(t\right)=\alpha I_a\left(t\right)+\beta B_a\left(t\right)+\gamma X_a\left(t\right),\alpha +\beta +\gamma =1,$$

(1)

where $I_a$, $B_a$, and $X_a$ denote identity, behavioral, and contextual evidence, respectively.

Identity evidence is derived from VC-attested attributes and decays with credential age. Let ${\Delta }_a^{\mathrm{vc}}\left(t\right)$ denote elapsed time since credential issuance and H the credential-validity horizon:

$$I_a\left(t\right)=max\left\{0,1-{\displaystyle \frac{{\Delta }_a^{\mathrm{vc}}\left(t\right)}{H}}\right\}.$$

(2)

Behavioral evidence compares the empirical action distribution ${\widehat{P}}_W$ over a sliding window of the previous k actions with the role-conditioned reference distribution $P_{\mathrm{role}}$:

$$B_a\left(t\right)=\left\{\begin{array}{cc}0,\hfill & \mathrm{current}\mathrm{action}\mathrm{is}\mathrm{out}\mathrm{of}\mathrm{scope},\hfill \\ 1,\hfill & \mathrm{fewer}\mathrm{than}k\mathrm{actions}\mathrm{have}\mathrm{been}\mathrm{observed},\hfill \\ exp\left[-\kappa D_{\mathrm{KL}}\left({\widehat{P}}_W\parallel P_{\mathrm{role}}\right)\right],\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(3)

The warm-up value of one avoids penalizing an agent before sufficient behavioral evidence has accumulated. Context combines attestation freshness, network posture, and temporal conformance:

$$X_a\left(t\right)=0.40x_{\mathrm{fresh}}\left(t\right)+0.35x_{\mathrm{net}}\left(t\right)+0.25x_{\mathrm{temp}}\left(t\right).$$

(4)

At evaluation step $t_j$, the behavior monitor assigns a risk magnitude $R_j\ge 0$ according to the observed event class: out-of-scope action, prompt/logic-injection signature, action rate above $3\sigma$ of the role baseline, unusual but in-scope action, or zero for a clean step. With ${\Delta }_j=t_j-t_{j-1}$, trust evolves as

$$T_a\left(t_j\right)=min\left\{{\overline{T}}_a\left(t_j\right),T_a\left(t_{j-1}\right)e^{\mu {\Delta }_j\mathbb{1}[R_j=0]}\right\}{e}^{-\lambda R_j}.$$

(5)

Thus, clean operation permits multiplicative recovery toward the current evidence ceiling, while a risk event attenuates the realized trust state and receives no recovery credit for that interval.

An agent is authorized only while $T_a\left(t\right)\ge \tau$. Crossing the threshold closes the trust-to-enforcement loop:

$$T_a\left(t\right)<\tau ⟹\mathrm{revoke}\left(a\right),$$

(6)

where $\mathrm{revoke}\left(a\right)$ invalidates the agent’s credentials and propagates a signed status update to enforcement points. Revocation is terminal in the present model, so the first threshold crossing constitutes the detection event.

Table 2 specifies the default synthetic operating point. Parameters $(\lambda ,\tau ,\beta )$ are additionally subjected to held-out calibration, with $\alpha$ and $\gamma$ rescaled proportionally when $\beta$ changes. The remaining parameters are fixed design choices. These values describe the simulator rather than recommended clinical deployment settings; a deployed system would require calibration against local behavior.

3.5. Experimental Method

We implement the identity, authentication, authorization, and revocation paths in a software testbed using liboqs [22] for post-quantum primitives and a standard cryptographic library for the classical baselines. Four configurations are evaluated: classical-only (Ed25519/X25519), PQC-only (ML-DSA-65/ML-KEM-768), hybrid (Ed25519+ML-DSA-65 and X25519+ML-KEM-768), and an SLH-DSA variant using SLH-DSA-SHA2-128f for signatures.

For each configuration we measure primitive latency, serialized DID/VC and delegation-token size, end-to-end handshake and authorization latency, and the latency of the trust-to-revocation path. BLE fragmentation is computed analytically as $\lceil \mathrm{bytes}/244\rceil$ using a 244-byte ATT payload within a 247-byte MTU. Latency distributions are collected over at least ${10}^3$ iterations after warm-up.

The trust mechanism is evaluated using independent Monte Carlo replications under fixed seed schedules. The default evaluation uses 1,000 runs for each of three attack and five benign scenarios. Binomial rates are reported with two-sided 95% Wilson intervals, while median delays use percentile-bootstrap intervals with 2,000 resamples. Seven paired component variants are evaluated over 300 runs per scenario, and benign-context stress experiments use 500 runs per scenario.

Held-out parameter selection evaluates 36 combinations of $\lambda \in \{0.5,1,2\}$, $\tau \in \{0.3,0.4,0.5,0.6\}$, and $\beta \in \{0.3,0.5,0.7\}$ using 100 calibration runs per scenario. The selected configuration maximizes pooled TPR minus pooled FPR subject to a training Wilson upper bound of 0.05 on the false-positive rate and is evaluated once on 500 disjoint-seed runs per scenario.

The generator assigns risk classes differently across scenarios. Out-of-scope and prompt-injection events occur only in A1 and A3, whereas the unusual-but-in-scope class occurs under A2 at 11.6% of generated actions and, at the default operating point, not under the benign generators. High-rate events may occur under both benign and adversarial scenarios. These assignments define the synthetic generator rather than clinical behavior and are explicitly stress-tested in the subsequent evaluation.

The testbed measures cryptographic operations on a general-purpose CPU and does not directly measure microcontroller latency, RAM, flash, energy, radio airtime, or packet loss. It exercises an initiator, a responder/device-proxy, and the associated trust and revocation services; consequently, it validates the cryptographic and revocation mechanics rather than large-population multi-agent dynamics.

4. Results and Analysis

4.1. Cryptographic and Communication Overhead

Figure 2 summarizes the computational and communication costs of the four evaluated cryptographic configurations. Relative to the classical baseline, hybrid and PQC-only identity artifacts expand substantially: Verifiable Credentials are approximately 5 KB and DID documents approximately 10 KB. The SLH-DSA configuration is the clear outlier because its 17 088-byte signature dominates the artifact in which it is embedded.

The computational cost is comparatively small on the evaluated general-purpose CPU. Classical, hybrid, and PQC-only signing and verification complete in well under 1 ms, and their end-to-end agent handshakes remain below approximately 1.5 ms. The SLH-DSA configuration requires substantially more computation, with signing near 11 ms and an end-to-end handshake of approximately 23.5 ms. This supports the use of lattice-based ML-DSA and ML-KEM in routine authentication, while positioning SLH-DSA more naturally for infrequent operations such as long-lived audit signatures.

The larger deployment cost is communication. At the 244-byte BLE ATT payload used in Section 3.5, hybrid and PQC-only DID documents require approximately 40 fragments, whereas the SLH-DSA configuration approaches 100 fragments per identity artifact. These values are analytic fragment counts derived from serialized payloads rather than measurements over a radio link. Nevertheless, together with the latency measurements they show that, on the evaluated CPU tier, quantum-safe identity is constrained more strongly by artifact expansion and constrained-link fragmentation than by lattice computation.

4.2. Trust Dynamics and Baseline Detection

Two properties of the trust model explain the baseline detection results. First, an out-of-scope action sets $B_a=0$ and, under the default parameters, bounds the evidence ceiling at ${\overline{T}}_a\le \alpha +\gamma =0.5$. Applying the corresponding $R_{\mathrm{scope}}=0.8$ penalty gives

$$T_a\le 0.5e^{-0.8}=0.225<\tau ,$$

(7)

so an out-of-scope action is sufficient to trigger revocation independently of the agent’s preceding history. Detection of A1 and A3 is therefore policy-enforceable rather than inference-based.

Adaptive in-scope behavior follows a different mechanism. A high-rate event with $R=0.3$ causes a one-step threshold crossing only when its pre-event trust satisfies

$$T<\tau e^{\lambda R}.$$

(8)

At the default $\lambda =1$ and $\tau =0.5$, this threshold is $0.675$. Consequently, adaptive-stealth detection requires two conditions to coincide: earlier low-magnitude risk must first depress the trust state below $0.675$, and a higher-rate event must subsequently arrive.

Figure 3 illustrates representative 24 h trajectories, while Table 3 reports the Monte Carlo evaluation over 1,000 independent runs per scenario. A1 aggressive scope abuse and A3 mimicry/scope abuse are detected in every run, consistent with Equation (7). Adaptive A2 stealth is detected in 20.2% of runs (95% CI: 17.8–22.8%) within the default 24 h horizon, with a median detection delay of approximately 11.0 h among detected runs. Across the five reliable-context benign scenarios, 92 of 5,000 runs are revoked, giving a pooled false-positive rate of 1.8% (95% CI: 1.5–2.3%).

Event attribution explains the comparatively low A2 rate. Across the 1,000 default runs, 206 high-rate events are generated. Of these, 202 arrive while trust is below the $0.675$ one-shot threshold, and precisely those 202 events produce revocation. The observed high-rate arrival frequency predicts a 19.9% probability of at least one such trigger during the post-compromise window, closely matching the measured 20.2%. Adaptive-stealth detection is therefore primarily limited by the arrival of sufficiently informative risk-bearing evidence rather than by cryptographic enforcement latency.

This interpretation is reinforced by the observation-horizon experiment. Keeping the generator and parameters unchanged while extending the horizon from 24 to 120 h increases A2 detection from 20.2% to 75.3% (Table 4). The increase demonstrates that the 24 h result is strongly horizon-dependent rather than an estimate of eventual detection. A separate disjoint-seed evaluation at the deployed threshold also shows that the longer window is not cost-free: the five-scenario benign false-positive rate rises from approximately 1.7% at 24 h to 29.3% at 120 h. Thus, the operative trade-off for adaptive stealth is between detection latency and benign revocation rather than between perfect detection and successful evasion.

4.3. Component Ablation and Context Stress

Figure 4 isolates the mechanisms responsible for the baseline result. Under the paired-seed schedule, the complete model yields a pooled TPR of 73.9% and FPR of 1.9%. Removing risk memory, using the memoryless weighted-score baseline, or removing the high-rate signal eliminates A2 detections while leaving the policy-enforceable A1 and A3 cases largely unchanged. This confirms the two-condition mechanism identified in Section 4.2: accumulated low-magnitude risk depresses trust, while the high-rate event provides the threshold-crossing trigger.

Scope enforcement is independently decisive. Removing scope control reduces A3 detection from 100% to 2.0%, showing that the mimicry/scope scenario is detected primarily through explicit policy enforcement rather than behavioral inference. Context plays the opposite role: removing contextual evidence slightly increases pooled attack detection to 76.2% but raises pooled FPR to 14.5%. Its main contribution in the present model is therefore suppression of false revocation under legitimate but atypical clinical conditions.

The context-stress scenarios make this dependency clinically explicit. An announced emergency override remains close to the baseline benign range (1.4% FPR on the stress-test seed schedule), whereas the same emergency burst without the expected contextual signal produces a 92.0% false-positive rate (95% CI: 89.3–94.1%). Network outage and stale-attestation stress produce smaller increases of approximately 4%, while combined context degradation raises the rate to 33.8%. These results are deliberately adverse stress conditions rather than estimates of clinical prevalence; they show that automatic revocation depends on reliable representation of legitimate break-glass and degraded-network context.

Held-out calibration selects $(\lambda ,\tau ,\beta )=(1.0,0.4,0.3)$. On disjoint seeds drawn from the same generator, this operating point yields a pooled TPR of 73.1% (95% CI: 70.8–75.3%) and no observed benign revocations (95% CI: 0.0–0.2%). This provides evidence against simple stochastic overfitting to the calibration seeds, but it does not test transport to a different institution, role distribution, or clinical-behavior generator.

4.4. Parameter and Benign-Assumption Sensitivity

Figure 5 summarizes one-at-a-time sensitivity around the default synthetic operating point. Adaptive-stealth detection is most affected by the behavioral sensitivity $\kappa$ and behavioral-window length k, followed by the high-rate risk magnitude $R_{\mathrm{rate}}$ and recovery rate $\mu$. Context weighting and the remaining risk magnitudes have comparatively small effects on A2 under its present generator.

The important result is the direction of the detection–false-positive trade-off rather than the absolute ranking. Increasing $\kappa$ from 2 to 4 raises pooled TPR by only 2.4 percentage points while increasing pooled FPR by 21.8 points. Likewise, shortening the behavioral window from 20 to 10 actions raises pooled TPR by 1.4 points but increases pooled FPR by approximately 20 points. In both cases, the additional attack detection is purchased at a much larger benign-revocation cost. The limited A2 detection at the default operating point is therefore not recoverable simply by making the present behavioral score more sensitive.

A more fundamental sensitivity concerns the generator assumption that benign agents do not emit the unusual-but-in-scope class $R_{\mathrm{unusual}}=0.2$ used by A2. To test this assumption, benign scenarios are replayed while emitting that class at a fraction of its adversarial rate. Table 5 reports the default condition, a 25% relaxation, and parity with A2. The five reliable-context clinical scenarios rise from a 1.7% false-positive rate on this independent seed schedule to 19.9% when benign agents emit the class at only one quarter of the adversarial rate. At parity, false revocation reaches 96.7%. Context-degraded scenarios are substantially worse throughout.

The 25% condition is particularly informative because its five-scenario false-positive rate of 19.9% is essentially the same as the 20.2% A2 detection rate at the default 24 h horizon. Trace inspection further shows that introducing this benign emission changes the mean behavioral score only minimally; the resulting separation is therefore driven primarily by the risk attenuation attached to the generator-defined event class rather than by a strongly discriminative change in the behavioral distribution itself.

This experiment should be interpreted as a sensitivity bound rather than as an estimate of clinical false-positive prevalence. The replay introduces the risk-bearing event label without modeling the full distribution shift that would accompany genuinely unusual benign clinical behavior. Nevertheless, it establishes a central limitation of the present model: favorable false-positive rates depend on the existence of behavioral evidence that remains substantially more common in the adversarial population than in legitimate operation. Accordingly, the main empirical contribution of the trust evaluation is not a claim of deployment-ready attack detection, but a characterization of where trust-triggered revocation is policy-enforceable, where it is detection-latency limited, and where its behavioral assumptions cease to provide useful separation.

5. Discussion

5.1. Principal Findings

The evaluation yields three principal findings. First, security enforcement in PQ-MedTrust separates into two mechanisms with different guarantees. Explicit scope violations are policy-enforceable: under the default model an out-of-scope action is sufficient to force trust below the authorization threshold, so A1 and A3 are revoked deterministically once the prohibited action occurs. Adaptive in-scope behavior is instead inference-based; possession of a valid credential and compliance with explicit scope rules do not imply that the subsequent behavior is benign. This distinction is important because a 100% detection rate for A1 or A3 should not be interpreted as evidence of statistical anomaly-detection accuracy. It primarily demonstrates correct enforcement of a policy condition.

Second, the adaptive-stealth result is governed primarily by evidence arrival. At the 24 h operating point, A2 is detected in 20.2% of runs. Event attribution shows that 202 of 206 high-rate events arrive while the accumulated trust state is below the one-step crossing threshold, and exactly those 202 events cause revocation. The observed event-arrival process predicts a 19.9% probability of such a trigger, closely matching the measured result. Extending the horizon from 24 to 120 h raises A2 detection to 75.3%. Under the present generator, the principal effect of adaptive stealth is therefore increased detection latency rather than permanent evasion. This result also exposes a limitation: a detector whose success depends on a rare risk-bearing event cannot shorten the period during which an adversary remains behaviorally indistinguishable using the current evidence alone.

Third, the favorable benign rate is conditional on the evidence model. The pooled false-positive rate over the five reliable-context clinical scenarios is 1.8%, but this value does not generalize automatically to degraded or behaviorally shifted conditions. An unannounced emergency produces a 92.0% false-positive rate, and allowing benign agents to emit the unusual-but-in-scope class at only one quarter of the A2 rate raises the pooled five-scenario rate to 19.9%, essentially matching the 20.2% A2 detection rate at the same 24 h horizon. The central trust-model result is therefore not that one operating point achieves uniformly strong detection, but that the evaluation identifies the conditions under which behavioral evidence remains discriminative and the conditions under which that separation deteriorates.

Taken together, these findings clarify the contribution of PQ-MedTrust. The architecture closes and measures the path from post-quantum identity and scoped authorization to continuous trust evaluation and credential revocation, while the behavioral experiments characterize both the useful operating region and its failure boundary. The cryptographic enforcement mechanism can therefore be assessed separately from the conditional inference mechanism that decides when such enforcement should be invoked.

5.2. Relation to Prior Work

Table 6 positions PQ-MedTrust against the closest empirical benchmarks while preserving their different hardware platforms, payloads, protocol scopes, and security tasks. The approximately 5 KB ML-DSA credential size is consistent with prior post-quantum VC measurements, while the CPU-tier signing, verification, and handshake results fall in the same general low-latency regime reported on general-purpose hosts. These comparisons support the feasibility of lattice-based identity operations at an edge or host tier, but they do not establish equivalent performance on constrained medical microcontrollers.

The constrained-device results make this boundary particularly important. Published Cortex-M0+-class measurements report substantially higher signing latency and memory requirements than our general-purpose CPU testbed, so the sub-millisecond PQ-MedTrust measurements support the architectural case for edge offload rather than a device-speed ranking. Likewise, the BLE and TLS comparators establish communication and transport context: our local agent-protocol measurements do not include a production Internet path, and the analytic BLE fragment counts do not measure radio airtime, retransmission, or packet loss.

Behavioral comparisons are necessarily less direct. SecHealth evaluates supervised healthcare-device classification, whereas DynaTrust evaluates adaptive-agent defense through historical and peer-informed trust graphs. Neither outcome is equivalent to action-level, trust-triggered credential revocation. Their results nevertheless reinforce an important direction for PQ-MedTrust: adaptive-agent defense benefits from evidence that does not depend on an adversary eventually emitting a rare self-incriminating event. The contribution relative to these literatures is therefore not a claim of a numerically superior detector, but a measured post-quantum identity–trust–revocation loop together with an explicit characterization of the limits of its behavioral evidence.

Table 6. Quantitative comparison with the closest empirical literature. Values from different hardware platforms, protocol scopes, and security tasks are contextual benchmarks rather than direct performance rankings.

Layer	Comparator	Published result	PQ-MedTrust result and comparison boundary
Credential	Arakawa [25]	ML-DSA-65 SD-JWT VC: 5,132 B; median sign/verify: 105.1/47.9 $\mu$s.	PQC-only VC: 5,013 B ($-2.3\%$); median sign/verify: 190.4/65.8 $\mu$s. The parameter set matches, but payload, host, language, and library path differ.
BLE transport	Sakk et al. [26]	Raw ML-KEM-768 exchange: 2,272 B and 10 BLE packets at a 247-byte MTU.	Full PQC-only/hybrid VC: 21/22 fragments; DID: 39/41 fragments using a 244-byte ATT payload. This compares a raw KEM exchange with complete identity artifacts.
Constrained device	Chhetri et al. [21]	RP2040 Cortex-M0+: ML-KEM-768 exchange 56.62 ms; ML-DSA-65 mean sign/verify 256.6/72.2 ms; sign p99 952.8 ms; peak signing stack 77.6 KB.	General-purpose CPU: PQC-only median handshake 0.625 ms and ML-DSA-65 median sign/verify 0.190/0.066 ms. The comparison motivates edge offload; it is not a device-speed ranking.
Network handshake	Gómez-Cambronero et al. [23]	Loaded TLS 1.3: PQC adds approximately 2–4 ms median end-to-end; TLS exchange 5.253–6.495 ms.	Hybrid/PQC-only local-agent handshakes have medians of 1.396/0.625 ms. The testbed does not include an Internet path or production TLS load.
Healthcare trust	SecHealth [8]	100–600 static devices; reported accuracy 93.5–96.7%, FPR 3.1–4.1%, and packet-delivery latency 85–95 ms.	Pooled benign FPR 1.8%; A1/A3 detection 100%, A2 detection 20.2%. Supervised device classification is not equivalent to action-level revocation, so accuracy is not ranked.
Adaptive agents	DynaTrust [9]	More than 86% defense success against sleeper agents on AdvBench/HumanEval-derived tasks.	Adaptive-stealth A2 detection is 20.2% within 24 h and 75.3% at 120 h. Graph-restructuring defense success is not equivalent to TPR under the PQ-MedTrust simulator.

Table 6. Quantitative comparison with the closest empirical literature. Values from different hardware platforms, protocol scopes, and security tasks are contextual benchmarks rather than direct performance rankings.

Layer	Comparator	Published result	PQ-MedTrust result and comparison boundary
Credential	Arakawa [25]	ML-DSA-65 SD-JWT VC: 5,132 B; median sign/verify: 105.1/47.9 $\mu$s.	PQC-only VC: 5,013 B ($-2.3\%$); median sign/verify: 190.4/65.8 $\mu$s. The parameter set matches, but payload, host, language, and library path differ.
BLE transport	Sakk et al. [26]	Raw ML-KEM-768 exchange: 2,272 B and 10 BLE packets at a 247-byte MTU.	Full PQC-only/hybrid VC: 21/22 fragments; DID: 39/41 fragments using a 244-byte ATT payload. This compares a raw KEM exchange with complete identity artifacts.
Constrained device	Chhetri et al. [21]	RP2040 Cortex-M0+: ML-KEM-768 exchange 56.62 ms; ML-DSA-65 mean sign/verify 256.6/72.2 ms; sign p99 952.8 ms; peak signing stack 77.6 KB.	General-purpose CPU: PQC-only median handshake 0.625 ms and ML-DSA-65 median sign/verify 0.190/0.066 ms. The comparison motivates edge offload; it is not a device-speed ranking.
Network handshake	Gómez-Cambronero et al. [23]	Loaded TLS 1.3: PQC adds approximately 2–4 ms median end-to-end; TLS exchange 5.253–6.495 ms.	Hybrid/PQC-only local-agent handshakes have medians of 1.396/0.625 ms. The testbed does not include an Internet path or production TLS load.
Healthcare trust	SecHealth [8]	100–600 static devices; reported accuracy 93.5–96.7%, FPR 3.1–4.1%, and packet-delivery latency 85–95 ms.	Pooled benign FPR 1.8%; A1/A3 detection 100%, A2 detection 20.2%. Supervised device classification is not equivalent to action-level revocation, so accuracy is not ranked.
Adaptive agents	DynaTrust [9]	More than 86% defense success against sleeper agents on AdvBench/HumanEval-derived tasks.	Adaptive-stealth A2 detection is 20.2% within 24 h and 75.3% at 120 h. Graph-restructuring defense success is not equivalent to TPR under the PQ-MedTrust simulator.

5.3. Design and Clinical-Safety Implications

The cryptographic and behavioral results impose different deployment constraints. At the evaluated CPU tier, lattice-based authentication adds little computation, while credential expansion and constrained-link fragmentation dominate the projected IoMT cost. This supports the three-tier architecture in which latency-sensitive policy enforcement remains close to the device while larger credential-verification, signing, and analytics operations are offloaded to edge or institutional services. These measurements do not, however, establish equivalent latency, memory, or energy performance on a medical microcontroller.

The behavioral mechanism imposes a stronger constraint. Increasing behavioral sensitivity produces only modest gains in adaptive-stealth detection while causing substantially larger increases in benign revocation. For example, raising $\kappa$ or shortening the behavioral window increases attack detection only slightly while pushing pooled false-positive rates above 20%. The present model therefore cannot recover the A2 limitation through more aggressive parameter tuning alone. Deployment requires additional evidence that remains discriminative under benign distribution shift rather than simply a lower threshold or larger behavioral penalty.

This limitation is especially important because revocation is terminal in the current architecture. In a conventional security setting, denying access when confidence is lost may appear conservative. In a clinical environment, the denied action may itself be safety-critical. The context-stress experiment illustrates the tension: an announced emergency remains close to the normal benign range, whereas the same emergency burst without the expected contextual signal produces a 92.0% false-positive rate. Break-glass context is therefore a safety-critical integration requirement rather than an optional optimization.

The result also suggests that binary terminal revocation is too coarse as the only response to uncertain behavioral evidence. A deployment-oriented extension could introduce graduated controls such as capability restriction, step-up authentication, temporary quarantine, human confirmation, or emergency-only authorization before permanent credential withdrawal. These responses are not implemented or evaluated in the present testbed and should therefore be treated as future design directions rather than demonstrated capabilities. Their motivation follows directly from the false-positive results: clinical-agent security must account for the harm of denying a legitimate action as well as the harm of permitting a malicious one.

5.4. Regulatory and Post-Quantum Transition Context

Three policy considerations motivate the design without implying that PQ-MedTrust itself establishes regulatory compliance. First, the HIPAA Security Rule requires mechanisms to record and examine activity in information systems that contain or use electronic protected health information [28]. Clinical authorization and audit evidence may remain relevant for long periods, making durable integrity and provenance important properties. The hash-chained, post-quantum-signed audit layer in PQ-MedTrust is intended to support these long-term accountability objectives; post-quantum signatures are a security design choice rather than a HIPAA-specific requirement.

Second, post-quantum migration guidance makes crypto-agility important for systems with long field lives. NIST transition guidance provides the broader migration context, while CNSA 2.0 provides a more prescriptive transition example for U.S. National Security Systems  [29,30]. These policies do not by themselves impose CNSA requirements on ordinary medical devices, but they illustrate the migration risk of binding a long-lived device or identity infrastructure permanently to one quantum-vulnerable algorithm. PQ-MedTrust therefore carries explicit algorithm identifiers to support rotation of verification methods while preserving the higher-level agent identity. Depending on the credential proof and issuer-key change, individual VCs may still require renewal or reissuance.

Third, automated credential revocation is itself safety-relevant. FDA cybersecurity guidance treats cybersecurity controls as part of medical-device quality and risk-management considerations  [31]. For a mechanism capable of withdrawing an autonomous agent’s authority, false revocation can deny a clinically necessary action. Deployment evidence must therefore characterize false positives, degraded-context behavior, break-glass operation, and safe fallback responses in addition to reporting attack-detection rates. In this respect, the negative and conditional results of Section 4.3 and Section 4.4 are at least as important for clinical deployment as the nominal detection rates.

5.5. Threats to Validity

The cryptographic results are software-library measurements on a general-purpose CPU. They do not directly measure energy consumption, RAM or flash footprint, radio airtime, packet loss, or microcontroller latency, and the BLE fragment counts are computed analytically rather than measured over a physical radio link. The device tier is therefore characterized partly by comparison with published constrained-device benchmarks rather than by direct target-hardware measurement.

The behavioral evaluation is synthetic. Attack and benign outcomes arise from author-specified action distributions, risk magnitudes, context policies, and adversary strategies rather than clinical telemetry. Two assumptions are particularly influential. Detection is conditional on the observation horizon: A2 detection rises from 20.2% at 24 h to 75.3% at 120 h under the same generator. The reported benign rate is also conditional on benign agents not emitting the unusual-but-in-scope class at a comparable rate; at one quarter of the adversarial rate, the five-scenario FPR rises to 19.9%. The latter experiment should be interpreted as a sensitivity bound rather than an estimate of clinical prevalence because it introduces the risk-bearing event without modeling the full behavioral distribution shift that could accompany genuinely unusual benign work.

Wilson and bootstrap intervals quantify finite-run uncertainty conditional on the simulator. They do not quantify model-form error, incorrect behavioral labels, institutional heterogeneity, or distribution shift. Similarly, the held-out evaluation draws disjoint seeds from the same generator and therefore tests stochastic overfitting rather than transport across hospitals, roles, or vendors. The parameters in Table 2 should consequently be read as a specification of the evaluated synthetic system rather than as recommended clinical deployment values.

Finally, the testbed exercises an initiator, a responder/device-proxy, and the associated trust and revocation services rather than a population-scale multi-agent deployment. The implementation validates the cryptographic, authorization, and revocation mechanics of the proposed architecture but does not experimentally establish large-scale delegation, coalition behavior, or revocation propagation across heterogeneous clinical-agent populations. These questions, together with target-hardware measurement and validation using institutionally governed clinical-agent telemetry, remain necessary steps toward deployment.

6. Conclusions

PQ-MedTrust presents and evaluates a post-quantum trust-to-revocation architecture for autonomous clinical agents operating at the IoMT edge. The architecture integrates DID/VC-based identity, scoped authorization, continuous identity–behavior–context trust, hybrid classical/post-quantum authentication, and signed credential revocation into a single enforcement path. On the evaluated general-purpose CPU, lattice-based post-quantum operations add modest computational latency: classical, hybrid, and PQC-only agent handshakes remain below approximately 1.5 ms. The larger practical cost is communication, with post-quantum identity artifacts expanding to several kilobytes and requiring tens of BLE fragments. These measurements support edge-tier cryptographic offload, but do not establish equivalent performance on constrained medical-device hardware.

The trust evaluation distinguishes deterministic policy enforcement from conditional behavioral inference. Explicit scope abuse and one-shot mimicry/scope violations are detected in all default runs because the prohibited action itself forces revocation. Adaptive in-scope stealth is more difficult: 20.2% of runs are detected within 24 h, increasing to 75.3% at 120 h under the same generator. Event attribution shows that the default A2 rate is largely determined by the coincidence of an already depressed trust state and arrival of a comparatively rare high-rate trigger. The resulting limitation is therefore strongly detection-latency dependent.

The experiments also define the boundary of the favorable operating point. The five-scenario pooled benign FPR is 1.8% under reliable context, but an unannounced emergency produces 92.0% false revocation, and allowing benign agents to emit the unusual-but-in-scope behavior at one quarter of the adversarial rate raises the pooled rate to 19.9%, approximately matching A2 detection at the same horizon. Parameter sensitivity further shows that making the current behavioral model more aggressive increases benign revocation much faster than attack detection. Accordingly, the present results should not be interpreted as deployment-ready clinical attack-detection accuracy. Their contribution is an implemented and measured post-quantum enforcement architecture together with an explicit characterization of where behavior-driven revocation succeeds, becomes detection-latency limited, and loses meaningful separation from benign behavior.

Future work should replace author-specified behavior with de-identified, institutionally governed clinical-agent telemetry; validate calibration across sites, roles, and vendors; and measure latency, RAM, flash, energy, airtime, fragment loss, and retransmission on target IoMT hardware. Deployment-oriented extensions should also evaluate graduated responses to uncertain trust, population-scale multi-agent delegation and revocation, and formal verification of authentication, delegation, downgrade resistance, and revocation under a quantum-capable adversary. Cross-institution evaluation will additionally be required to determine whether DID/VC identity semantics, behavioral reference distributions, and trust operating points transport across administrative domains.