Source-linked AI summary
Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems
Sibo Liu
TL;DR
Personal language agents can leak facts across audiences when assembling prompts from shared memory. This paper introduces an audience-membership authorization boundary before context assembly. On a synthetic suite, no forbidden fact entered unauthorized context across 79 scenarios, with every audited read path failing closed.
Problem
Shared-memory agents can retrieve facts learned in one conversation into prompts for another audience, while relevance-only retrieval and output filtering do not control authorization before model exposure.
Method
The boundary tags each memory item with its recording audience and admits it only when every current viewer belonged to that audience, failing closed when metadata is ambiguous.
Results
0 of 79 scenarios contained a forbidden fact in unauthorized context, while authorization matched policy in all scenarios and fail-closed coverage was 16/16.
Takeaways & Limitations
The model-neutral boundary provides cross-channel recall for authorized participants while confining narrower-audience facts from broader audiences by exclusion.
Takeaways & Limitations
The evidence is synthetic, and the zero-leakage result follows by construction rather than measured attack success.
Abstract
from arXiv · showhide
A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context containing a fact relevant to the query yet unauthorized for the current viewers. We introduce authorization before context: a single, anti-monotone audience-membership rule applied at the memory-to-context transition. Each item carries the audience present when it was recorded; the current viewer set is read from channel metadata and falls back to public when ambiguous; and the item is admitted only when every current viewer already belonged to its audience. We prove that this rule gives every participant cross-channel recall while ensuring, by exclusion rather than by model behavior, that nothing recorded for a narrower audience reaches a broader one and that poisoned memory cannot widen its own audience. The boundary is a model-neutral invariant on the exact assembled context: a forbidden fact must be absent before the model is called. On a synthetic Contextual-Integrity suite, no forbidden fact entered the context our boundary assembled, whereas unscoped baselines included such facts by construction; we further audit that every read path fails closed. The evidence is preliminary and synthetic.
1 Introduction
Persistent memory moves a personal language agent’s security boundary to the memory-to-context transition, where relevance-only retrieval, output filtering, and product-level isolation leave authorization gaps. The proposed audience-membership boundary admits items before prompt assembly, preserves cross-channel recall for participants, and confines facts to their recorded audiences.
- Problem: Persistent memory lets a delegated personal language agent assemble prompts from recent messages, long-term memory, and retrieved knowledge while participating in private, one-to-one, and group conversations.This expands the security boundary beyond a single owner conversation.
- Problem: Relevance-only retrieval ignores current viewers, while output filtering acts after unauthorized facts have entered model context and product isolation avoids the underlying authorization question.Redaction cannot undo prompt exposure, and acceptable answers do not prove forbidden input was absent.
- Contribution: The authorization boundary admits memory by audience membership before prompt assembly, rather than by relevance or post hoc output filtering.It therefore prevents unauthorized facts from reaching the model while using one shared store instead of per-silo memory.
- Contribution: A single audience-membership rule is designed to preserve each participant’s cross-channel recall while confining every item to its audience in one direction.The viewer set is read from transport metadata rather than supplied as authoritative policy and resolves fail-closed when ambiguous.
- Contribution: The work enforces a portable, model-neutral invariant on the exact assembled context through exclusion, supported by authorization traces across three structurally different memory stores on a synthetic suite.The same audience decision governs the three stores.
2 Threat model
The threat model concerns a personal agent serving one owner across private and shared channels, with cross-audience access risks centered on memory-to-context assembly. The studied boundary must reject uncertain or unauthorized retrieval before the model is called, using audience membership rather than content redaction.
- The protected assets include conversation information, derived memory, assembled model-call context, and audience labels with provenance.
- The threat model includes cross-audience prying and channel ambiguity across owner-private, one-to-one, and group conversations.
- The trust boundary is memory-to-context assembly, because unauthorized items are already exposed once they enter the prompt.
- Retrieval fails closed when viewers are uncertain, and admission is based on audience membership rather than content redaction.
3 The audience-membership boundary
The audience-membership boundary admits a memory item only when every current viewer belonged to the item’s recording audience, using channel metadata and failing closed to public-only when that audience is ambiguous. This single exclusion rule provides cross-channel recall while preventing narrower-audience facts and poisoned memory from reaching broader audiences before model invocation.
- Audience representation: Each memory item carries its recording audience, while current viewers are resolved from channel metadata rather than channel identity.Audiences are defined by resolved member sets, so turns across different channels share scope when their members coincide.
- Admission rule: An item enters context only when every current viewer already belonged to its audience; missing or inconsistent metadata fails closed to public-only.Unauthorized items are excluded independently of model behavior.
- P1 (one-way confinement): The rule confines facts to authorized viewers and prevents anything recorded for a narrower audience from reaching a broader one.This is the stated one-way confinement property, enforced at admission.
- P2 (anti-monotonicity): Smaller current audiences admit at least as much, enabling cross-channel recall for one-to-one conversations while groups exclude facts whose audiences omit any member.The owner sees the union of all items, combining confinement with recall across containers.
- P4 (poisoning containment): Write-time audience binding contains poisoned memory: planted items can reach only viewers already within their authenticated origin audience and cannot enlarge it.This confidentiality property does not prevent planted content from reaching authorized viewers, including the owner.
4 Evaluation protocol
The evaluation uses a fixed-seed, synthetic Contextual-Integrity suite with authorization active on every read path, measuring forbidden facts in the exact context before answering. It compares the audience rule with definitional projections and audits that authorization is resolved before prompt assembly.
- Evaluation setup: The fixed-seed generator assigns Contextual-Integrity labels to facts and audiences, uses no real messages, and evaluates authorization on every read path.The cited configuration uses seed 42617 and covers 79 scenarios across 13 families.
- Results: 253/253 model-neutral authorization assertions pass across the evaluated decision checks.The result is the per-query conjunction of the model-neutral decision checks, not a separate measurement.
- Metrics and scenarios: The primary metric counts forbidden facts in the exact-context artifact before any answer, alongside agreement with the expected audience policy and fail-closed behavior.The scenarios span owner-private, exact-shared, directional cross-channel, fail-closed, adversarial, and poisoning settings.
- Baselines and audit: The unscoped projection includes forbidden facts by construction, while the evaluation also audits every prompt-context read path for authorization before assembly.The baseline is a definitional projection over the same scenarios rather than a tuned runtime.
5 Results
Authorization-before-context prevented forbidden facts from entering assembled context across all 79 synthetic adversarial scenarios, with every tested authorization decision matching policy and all read paths failing closed. Audits also covered structurally different stores and a human-reviewed live-regression fixture, while identifying an aggregate knowledge-graph summary that requires fail-closed handling.
- Synthetic authorization results: 0 of 79 scenarios entered unauthorized context under any adversarial setting, and a hermetic real-read-path run reproduced 0/79.The observed authorization decision matched expected policy in all 79 scenarios; fail-closed coverage was 16/16 and permitted-context coverage was 79/79.
- Retrieval-path audit: A single audience decision derived from current viewers governed retrieval across recency, summarized long-term, and knowledge-graph stores.Each store enforced the decision at a different point, and recent-message recall was confined to the current turn.
- Retrieval-path audit: The directlookup primitive enforced audience checks internally, returned identical not-found responses for absent and unauthorized entities, and made every path fail closed.A knowledge-graph entity summary could span audiences without per-item provenance, so it could not be checked fact-by-fact and was handled fail closed.
- Live regression: A human-reviewed live-regression fixture matched the approved baseline row by row across repeated primary and fallback runs of a pinned real model.The fixture captured the exact assembled context, while verification records were retained internally pending review for release.
6 Related work and limitations
The paper distinguishes its audience-membership, fail-closed context boundary from related memory-leakage systems that assess outputs or recovered data. It acknowledges synthetic, construction-based evidence and outlines limitations and future work in coverage, write admission, and adversarial evaluation.
- Related work: The closest prior system, Collaborative Memory, differs in access unit and viewer-evidence handling: this work uses participant audience membership and fail-closed transport metadata.The paper attributes antimonotone recall and one-way confinement to its membership basis.
- Related work: This work checks the assembled context before model output, preventing leaks by construction rather than scoring violations in outputs or recovered data.The comparison includes CIMemories, AgentLeak, MAGPIE, memory-extraction, and channel-leakage studies.
- Limitations: The data are synthetic, and zero leakage follows from a deterministic membership test rather than measured attack success; the design deliberately accepts overblocking over inferred audience unions.Audience widening is identified as the recall-completeness dual of leakage and a possible future direction.
- Future work: Future coverage should drive the same audience decision through every claimed store, including graph-backed retrieval, which the hermetic run audits but does not exercise as a seeded benchmark mate.This limitation concerns the boundary’s coverage across read paths.
- Future work: Future evaluation should measure write admission, extend containment from read-time exclusion to record-time binding, and broaden adversarial tests across forged metadata, stale labels, multi-hop transitions, and overlapping audiences.The proposed baselines should expose which boundary each alternative lacks rather than form a leakage leaderboard.
Ethics, reproducibility, and AI-use disclosure
The paper uses synthetic or redacted artifacts and reports reproducibility metadata without publishing private deployment details. It also discloses AI assistance while retaining author responsibility for claims, evidence, and accuracy.
- Reproducibility: The evaluation uses synthetic or redacted boundary artifacts and omits private messages, prompt bodies, provider settings, and cloneable deployment details.Appendix artifacts are synthetic.
- Reproducibility: Fixture-seeded benchmark reports record source revisions, commands, artifact digests, disclosure levels, and replay metadata.Live-verification artifacts support operations and accountability rather than disclosing private live traces.
- AI-use disclosure: AI tools assisted with drafting, revision, citation-format cleanup, and figure integration, while the author directed claims and evidence selection and remains responsible for accuracy.All text, citations, figures, and conclusions require author review before submission.
A Related-work comparison
The section situates the audience-membership boundary alongside the closest prior systems and authorization frameworks. Table 2 presents this comparison across specified dimensions without revealing private implementation details.
- The section avoids exposing private implementation detail while presenting the comparison.
- Table 2 compares the audience-membership boundary with the closest prior systems and authorization frameworks.
- The comparison is organized around related-work dimensions summarized in Table 2.
B Reproducibility and artifact seal
The appendix seals the synthetic and redacted evidence package with reproducibility and integrity metadata rather than production source or private traces. Its baseline contrast shows that authorization preserves allowed recall while excluding forbidden facts, unlike the unscoped baseline.
- B Reproducibility and artifact seal: The seal records the run identifier, source revision, generator seed, metric numerators and denominators, and public artifact digests.It covers the synthetic and redacted evidence package, not production source or private runtime traces.
- B Reproducibility and artifact seal: 79/79 allowed facts were retained while 0/79 forbidden facts were admitted by the full boundary across 79 scenarios.The unscoped real-path baseline retained the same allowed facts but admitted 79/79 forbidden facts by construction.
- B Reproducibility and artifact seal: The one-store diagnostic admitted 0/79 forbidden facts but retained only 76/79 allowed facts because it omitted allowed facts outside that single store.It is a synthetic diagnostic projection rather than the evaluated full boundary.
C Claim-to-evidence closure
The paper ties each claim to machine-readable artifacts and supporting metrics or structural checks, while explicitly excluding claims beyond this evidence boundary. Action safety, semantic audience widening, production reliability, and broad memory quality remain future work or are left unclaimed.
- Evidence closure: Each paper claim is linked to machine-readable artifacts rather than prose-only assertions.Table 5 identifies the public artifact families used to close each claim.
- Evidence closure: Claims outside the evidence boundary are excluded or left for future work.The passage specifically names action safety, semantic audience widening, production reliability, and broad memory quality.
D Worked synthetic scenario
A synthetic directional cross-channel scenario compares the same seed material with the audience boundary disabled and enabled. Disabling authorization admits an Alice-only fact, while enabling it leaves only the group fact and no forbidden fact in the assembled context.
- D Worked synthetic scenario: The scenario renders identical synthetic seed material under unscoped baseline and scoped boundary-enabled conditions.The comparison uses one directional cross-channel scenario and abbreviates repeated fact identifiers for brevity.
- D Worked synthetic scenario: With authorization disabled, the unscoped baseline includes the Alice-only fact in the assembled context.
- D Worked synthetic scenario: With authorization enabled, the observed context contains only the group fact, an empty forbidden-included set, and no exact-context row for the forbidden fact.