PaperlayerView exact revision on arXiv

Source-linked AI summary

Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services

Bowen Sun, Zhengyue Zhao, Xiaogeng Liu, Yinzhi Cao, Chaowei Xiao

arXiv:2608.17445v1cs.CRcs.CL

TL;DR

Decomposition attacks evade stateless safeguards by splitting harmful tasks across unlinkable identities, raising the question of whether stateful defenses can stop them without reliable grouping. The paper derives security–utility frontiers and evaluates them on executable tasks, finding that retries and feedback eliminate favorable operating points.

  • Problem

    The paper asks whether stateful defenses can stop decomposition attacks when attackers use unlinkable identities and pool answers off service.

  • Method

    The paper derives an exact security–utility frontier and validates it with 91 executable tasks and 11,393 capability-matched benign requests.

  • Results

    99.4% ASR is reached by a learner using only ALLOW/BLOCK feedback, versus 47.2% for a fixed profile, while retries eliminate favorable operating points.

  • Takeaways & Limitations

    Effective protection requires independent linkage or costly identities and retries when visible groups do not reveal answer pooling.

  • Takeaways & Limitations

    The conclusions are conditional because public corpora do not reveal off-service pooling or reliable account linkage.

Abstract

from arXiv · show

Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attackers can use unlinkable identities and combine answers elsewhere, leaving no reliable grouping signal. We ask whether decomposition attacks can still be stopped under this setting. For a fixed attack strategy without retries, we prove that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped. Persistent, recognizable groups permit a useful defense; fresh, indistinguishable groups do not. When attackers can retry and learn from Allow/Block decisions, this useful operating point disappears: the feedback reveals what passes but not whether a block was correct. Experiments on 91 executable tasks and 11,393 capability-matched benign requests support these results. Under a 1% denial cap for these requests and a 0.5% cap for unrelated background traffic, all ten tested policies, including one privileged policy with an exact request-to-operation map, either fail to stop attacks or exceed the budget. On defense-unseen task families, attack success is at least 99% after one attempt and 100% after two. Effective defenses therefore require additional evidence or mechanisms tied to grouping, such as reliable identity linkage, costs for fresh identities, or control over answer use.

1 Introduction

Decomposition attacks evade stateless safeguards by distributing individually permissible subtasks across requests and combining their answers into harmful results. The paper develops idealized stateful defenses and validates that retries and unlinkable grouping undermine robust protection under low benign-denial constraints.

  • Motivation: Decomposition attacks split harmful tasks into individually permissible requests whose answers are combined, making each step indistinguishable from benign use.Stateless safeguards cannot resolve this ambiguity from current-request classification alone.
  • Stateful defense: Accurate grouping lets a stateful monitor accumulate answers and block task completion, whereas split attack histories and merged benign histories cause distinct errors.The defender may observe request semantics and metadata, but attackers can distribute tasks across identities the service cannot connect.
  • Theoretical analysis: The ideal defender receives complete visible history, exact service-visible group labels, unrestricted causal computation, and optional exact capability semantics.This model weakly dominates less-informed defenses within the observation boundary while withholding who will combine answers off-service.
  • Benchmark: 91 executable harmful tasks require 365 distinct functionality pieces and are paired with 11,393 benign requests for the same functionality.The benchmark varies which request supplies each combined answer and includes unrelated normal traffic, preventing success based solely on wording.
  • Experimental validation: 99.4% ASR is reached by a learner using only ALLOW/BLOCK feedback, versus 47.2% for a fixed profile.Replays reproduce the theoretical frontiers to numerical precision, while retries eliminate favorable operating points and deployable defenses underperform the ideal defender.

2 Background and Related Work

Decomposition attacks differ from jailbreaks and multi-turn attacks because no individual response need be harmful; the harm emerges only when benign-looking subtasks are combined. Prior stateful defenses succeed when they observe the interaction or grouping through which responses are shared, whereas hidden off-service sharing separates visible accounts from the security-relevant coalition.

  • Decomposition attacks: Decomposition attacks distribute a harmful objective across individually permissible requests, so the violation appears only in their composition.Prior work formalizes information leakage through combinations and delegation of benign-looking subtasks to stronger aligned models.
  • Stateful monitoring: Stateful systems such as DecomposedHarm, TurnGate, and Paranoid Monitors benefit when they observe the history across which responses are shared.These systems respectively accumulate dialogue, identify the earliest capability-closing response, or separate state tracking from judgment.
  • Related systems: TwinGate retrieves earlier globally interleaved requests by matching their inferred intent and carries a decision from one request over to another.The paper changes the security unit from requests sharing an intent label to capabilities acquired by a hidden access coalition, adding exact operation semantics, balanced role recoloring, hidden assignments, and retry.
  • Observability: The observability gap is that account linkage forms the visible partition while off-service answer sharing forms the security partition.Related work also frames detection around base rates and normal-traffic overlap, mimicry around observable-feature gaps, and Sybil defenses around accounts versus actors.

3 Problem Formulation and Threat Model

The paper formalizes decomposition attacks around protected tasks, attacker-controlled semantics and unlinkable identities, and causal defenses limited to service-visible traces. It defines benign-request populations and task-level security and utility metrics that distinguish attack success from request blocking.

  • 3.1 Tasks and successful decompositions: A protected task is catalogued only when direct harm is refused, the attacker’s local model needs service help, and the task decomposes into nh > 1 individually allowable requests.The decomposition is evaluated in detached histories with neutral accounts.
  • 3.1 Tasks and successful decompositions: Each request maps to required operations through Cap(Bt), and abstract task success occurs when the attacking coalition’s ledger contains the complete set Ih.Realized success additionally requires every answer to parse and pass its operation tests.
  • 3.2 Attacker capabilities: Attackers control request semantics, ordering, retries, and visible identity, including submission through fresh groups unlinkable to earlier groups.A single access coalition may pool answers across many mutually unlinkable visible groups off service.
  • 3.3 Defender observations and capabilities: The causal defender sees request bodies, earlier request history, and exact visible group labels, then must ALLOW or BLOCK before releasing each answer.The defender does not observe future requests or evaluator-only answer destinations.
  • 3.3 Defender observations and capabilities: Off-service pooling is invisible when service-visible traces are identical, so causal post-processing cannot reveal the access partition; Πideal adds only exact Cap(Bt) semantics and still lacks that partition.Request-only decisions also avoid buffering generated text and delaying time to first token.
  • 3.4 Requests from other users: Matched controls provide attack-matching capabilities without pooling them into protected tasks, while ordinary background requests provide no registered catalogue operation.These populations may use persistent or fresh visible groups, but benign access coalitions do not collectively obtain every operation required by a protected task.
  • 3.5 Security and utility metrics: Security is measured by task-level abstract attack success rate (ASR), whereas utility uses matched-control denial (MCD) and background block rate (BBR); request-level separation is ρ = ATK/MCD.Experiments report family-average ASR, while theory studies worst-task and fixed-portfolio ASR.

4 The Causal Capability Frontier

The section shows that decomposition-defense limits are governed by what request grouping reveals: stable, distinguishable benign groups permit useful protection, whereas exchangeable attack and control groups do not. Retry with ALLOW/BLOCK feedback removes the favorable static separation unless the service adds independent linkage or a real cost for further attempts.

  • Observation limits: An ideal defender dominates every causal policy restricted to the service’s observation boundary, so its security lower bounds apply to all such policies.The ideal policy has the same pathwise ALLOW/BLOCK decisions and metrics as any competing causal policy.
  • Observation limits: Request traces and transcript-derived signals cannot identify off-service pooling, coalition relations, or block correctness when pooling worlds induce the same visible history.The closure covers candidate text, embeddings, classifier scores, retrieval, summaries, logits, activations, extra samples, and parameter updates.
  • Grouping frontier: The robust blocking cost is at least the transversal number τ(H) of the completion hypergraph, because safety across all compatible hidden partitions requires intersecting every harmful completion edge.Requests are vertices, and minimal answer-completing sets are hyperedges.
  • Grouping frontier: When attack and control grouping laws are exchangeable, blocking attacks more often necessarily increases matched-control denial; stable recognizable control groups instead allow near-zero ASR with vanishing matched-control denial.At the easy endpoint, repeat confirmation exploits repeated benign groups while fixed attacks use fresh groups; at the hard endpoint, fresh groups provide no repetition to exploit.
  • Retry and feedback: Retry makes a control-only denial rate non-multiplicative and drives attack success toward 1 when every necessary operation retains positive per-attempt success probability.The finite-retry frontier recovers the static frontier at R = 1, while V_R →1 as R →∞ under the stated condition.

5 Dataset and Experimental Protocol

The experiments instantiate the threat model with executable cyber tasks, matched benign controls, unrelated background traffic, role-exchangeable replays, varied control densities and groupings, and multiple defenses. They also test finite-budget attacker learning from ALLOW/BLOCK feedback under common observation channels.

  • Task pipeline: 500 synthetic cyber programming tasks were created in a local sandbox, with 491 remaining after nine pipeline-development tasks for the frozen procedure.Each task specifies an unauthorized parent objective, two to six required output fields, a reference implementation, field tests, and a complete verifier.
  • Traffic construction: 1.5 million ordinary request rows formed a separate background bank to measure blocking unrelated traffic and other effects omitted by the simplified theory.The bank contains 1.2 million WildChat rows and 150,000 each from StackExchange and MS MARCO; the latter two pass a unanimous screen by three guard models.
  • Evaluation cohorts: 91 tasks from 82 families formed the main common-support cohort, covering 365 operations, 11,393 controls, and 2,190 passing task tests.Families were split by stable hash into 30 training, 20 attacker-adaptation, 12 calibration, and 20 final-evaluation families.
  • Replay design: Four legal benign groupings—singleton, operation-persistent, constructive-k2, and conditional iid k256—were replayed across control multipliers m_C from 1.00 to 26.75 on the main split.Four certified alternatives per operation were reserved for attack retry, while remaining controls were cut at six nested prefixes.
  • Defense evaluation: M0 and realizable defenses M1–M8 received a common causal channel containing request bodies, history, visible groups and metadata, previous decisions, and arbitrary state.The comparison also included a coalition-aware completion oracle outside that channel and a post-hoc best-of-class reference on it.
  • Attacker learning: UCB1 and Thompson sampling trained only on 20 attacker-adaptation families using the attacker’s ALLOW/BLOCK bit, with a separate learning grid R ∈{1,2,4}.The selected profile was frozen for final evaluation, while a retrospective best profile reported regret.

6 Frontiers for an Ideal Defender

Experiments instantiate the analytic frontiers and show that benign-group persistence strongly affects one-attempt security, while retries and limited Allow/Block feedback undermine these operating points. Exact operation labels isolate attribution and accumulation from semantic-recognition errors.

  • Analytic frontiers: D = 1,998 taskwise minimum costs across 11,393 real controls, while a balanced bank costs 24.93% MCD for zero worst-task ASR.The balanced bank assigns one control to each of 365 operations; replay matches the analytic frontier within frozen Monte Carlo tolerance.
  • Analytic frontiers: 0.80% MCD reaches zero ASR with operation-persistent groups, versus 17.54% for singleton groups under one attempt.The endpoints differ only in whether visible repetition identifies a stable benign group.
  • Arbitrary groupings: At 1% MCD, conditional-iid novelty yields 35.96%, 80.24%, and 90.85% ASR at the 5th, 50th, and 95th percentiles across 1,800 partitions.On the exactly solvable singleton instance, novelty, the unrestricted causal optimum, and the hindsight optimum agree at every tested budget.
  • Retries: 98.75% median ASR after sixteen attempts rises from 80.24% after one attempt at 1% MCD across the same conditional-iid partitions.Different sampled groupings induce different benign costs, so the distribution cannot be recovered from the retry limit alone.
  • Finite-budget adaptation: 99.4% ASR under Thompson sampling exceeds 47.2% for a fixed profile across 3,072 cells using only attacker ALLOW/BLOCK bits.These bits do not reveal whether a block disrupted an attack coalition or an ordinary user, providing no corresponding attribution signal.

7 Realizable Defenses and Privileged References

Realizable defenses can recognize capabilities, but under strict utility caps they cannot reliably distinguish attack requests from matched benign controls. Favorable static operating points disappear under retries, fresh identities, and feedback-based adaptation.

  • Capability recognition: AUROC 0.758 shows partial task-completion recognition, while five of eight score functions achieve AUROC 0.969 to 0.989 for registered capabilities versus background.Catching every completing set incurs 48.3% false positives, so weak defense is not explained solely by poor capability understanding.
  • Static operating points: M5 achieves 97.64% abstract ASR as the best admissible realizable method under the 1% MCD and 0.5% BBR caps.Other methods either exceed the matched-control cap or block nothing or virtually nothing.
  • Static operating points: 99.01% to 100% ASR remains for methods satisfying both caps on the outer cohort, while zero ASR first appears at 65.40% denial.Direct threshold reoptimization still yields 96.29% ASR at 1% MCD and 60.25% at 10%.
  • Privileged references: 22.35% online denial versus 17.12% for an offline hitting set yields a 1.31× causality premium even with global accumulation.Thus exact semantics and global state exceed the offline bound.
  • Dynamic attacks: M1 and M8 fall from 8.75% and zero one-attempt ASR to 98.75% and 98.88% after one certified retry, reaching 100% at five attempts.The same frozen defenses therefore do not preserve their favorable static operating points.
  • Dynamic attacks: 99.43% minimum one-attempt ASR at mC = 11.553 becomes 100% after two attempts, while Thompson sampling reaches 99.4% using only ALLOW/BLOCK outcomes.The attacker treats legal request and identity profiles as arms and adaptively selects requests without inferring the monitor’s representation or threshold.

8 Discussion and Limitations

The discussion separates semantic recognition from coalition attribution, showing that state preserves existing sharing signals but cannot create them from request similarity alone. The conclusions remain conditional on finite profiles and declared traffic, while effective defenses require independent pooling evidence or constraints on answer combination.

  • 8 Discussion and Limitations: Grouping governs the security frontier: recognizable repetition helps against fixed one-attempt attacks, whereas retries expose an allowed profile through ALLOW/BLOCK feedback.Even exact service-visible groups and operations cannot reveal off-service pooling; the lower bounds also apply to weaker policies without a semantic oracle.
  • 8 Discussion and Limitations: State preserves evidence that tracks sharing but cannot create that evidence from request similarity alone.Evaluations should report the accumulation unit, evidence binding requests to it, and effects of fresh identities, retries, and feedback.
  • 8 Discussion and Limitations: The conclusions are conditional because public corpora reveal neither off-service pooling nor reliable account linkage, so experiments assess declared traffic and constructed non-pooling controls.The cohorts provide mechanism evidence under finite profiles, rewrites, synthetic cyber tasks, and changing provider API aliases.
  • 8 Discussion and Limitations: Removing the matched controls’ construction prefix eliminates source separation while preserving capability recognition, without establishing behavior on natural traffic.The ledger credits an operation upon answer release; output filtering or persistent test-time training can alter the delivered response without adding pooling evidence.
  • 8 Discussion and Limitations: Effective defenses must add independent pooling evidence or constrain what can be combined, through mechanisms such as linkage, reputation, controlled access, restricted tools, or sandboxing.These mechanisms escape the result but impose access and evasion costs; positive stateful-defense claims should report their accumulation unit and why it tracks sharing.

9 Conclusion

Even an ideal defender cannot simultaneously maintain low benign denial and low attack success under retries and feedback when it sees linkable groups but not who pools answers. Effective protection therefore requires independent linkage or costly identities and retries.

  • 9 Conclusion: The 91-task evaluation shows that linkable groups alone do not let an ideal defender achieve both low benign denial and low ASR under retry and feedback.The defender sees groups but not who pools answers.
  • 9 Conclusion: Effective protection requires independent linkage or costly identities and retries.These mechanisms address the missing linkage or raise the cost of repeated unlinkable participation.

A Proofs and Formal Details … B.2 Capability layers actually measured

The appendix proves lower bounds and exact frontiers for stateful defenses under hidden grouping, retries, and feedback-driven exploration, then documents the capability layers and replay bank used for empirical verification. Its formal results connect attack disruption to hitting sets, retry accounting, and finite-profile estimation, while the measured data distinguish qualified operation realizations from broader screened sources.

  • A.1 Proof of Proposition 2: The nonidentification construction keeps every visible trace fixed while varying the latent partition between pooled and separated worlds, so the policy emits identical actions.The construction fixes bodies, metadata, group labels, order, private policy seed, and all other observable variables.
  • A.2 Hitting-set lower bound: Robust zero ASR requires a blocking set that intersects every minimal completion edge, yielding the hitting-set lower bound |S| ≥ τ(H).The completion hypergraph’s vertices are registered request occurrences, and its edges are minimal completion sets.
  • A.3 Proof of Theorem 1: Worst-task ASR q obeys q ≥ 1 − B/D until the bound reaches zero, where D is the aggregate matched control cost for fully disrupting tasks.One-attempt role exchangeability makes the hitting-set cost exact, and a campaign-coin policy attains Equation 2.
  • A.4 Retry accounting: Retry accounting gives E ≥ Rdx/[1+(R−1)dx] and therefore x ≤ β/[d{R−(R−1)β}], with an attaining policy that blocks all R attempts of chosen workflows.Here R is the retry limit, d is the minimum-share quantity, β is the rate budget, and x is the disruption probability.
  • A.4 Retry accounting: When utility is measured by fully blocked benign-workflow share f, the retry limit disappears and the bound becomes x ≤ f/d.The same attaining policy blocks all R attempts, counted once under f and R times under β.
  • A.5 Finite-profile exploration: After n observations per profile, the release-probability error is ε = sqrt(log(2M/δ)/(2n)) with probability at least 1 − δ, and empirical maximization loses at most 2ε.The profile count is M = ∑i |Ai|, and the selected task value is within min{1,2mopRε} of Equation 7.
  • B.2 Capability layers actually measured: 262 of 262 qualified assemblies succeed, while 262 of 491 screened catalogue tasks qualify for the frozen bank’s operation-realized layer.Every credited attack or control occurrence has a verifier-passing operation output; the agreement reflects bank assembly rather than model reliability.
  • B.2 Capability layers actually measured: Of 1,152 source requests, 1,151 are certificate-eligible; 45,877 static-valid candidates produce 45,629 target responses, and the retained bank spans four language conditions and eight benign genres.It also covers six organizations, five registers, and three model backends; background rows total 1.5 million across training, calibration, validation, test, StackExchange, and MS MARCO sets.

B.3 Concrete defense implementations

The defense suite fixes calibration constraints, model settings, prompts, and state representations for reproducible evaluation. Four LLM adaptations use distinct monitoring views, while implementation logs document scoring volume, repairs, and baseline choices.

  • Calibration and shared configuration: Thresholds were calibrated under matched-control denial ≤1% and WildChat background blocking ≤0.5%, then applied unchanged to test.M4–M7 used temperature zero, disabled thinking, fixed prompts, JSON outputs, 4,096-token context, 64-token scores, and 256-token summaries.
  • Monitor prompt contracts: M4–M7 instantiate global clustering, sequential-prefix, causal-retrieval, and neutral-ledger monitors for complementary harmful or unauthorized cyber steps.Their prompts distinguish duplicates, paraphrases, ordinary related development, potentially benign individual requests, false retrievals, and raw-request exclusion.
  • Execution and reliability: 762,087 score calls and 27,330 summary calls were produced, with 135 score repairs and 1,766 summary repairs; transport failures and final score abstentions were zero.Granite added 1,211,758 new batch-16 scores and reused 300,000 pinned external-source scores.
  • Baseline and construction choices: All LLM baselines in the horizontal comparison used the same 2B checkpoint after a planned 35B scoring arm was rejected on measured cost.The construction attacker and its frozen prompts, generation limits, and server attestation accompany the construction ledger.

B.4 High-density dynamic result with uncertainty and cost · B.5 Class separation and denominator sensitivity · B.6 What the scores separate

The appendices show that dynamic feedback can drive attack success near the known-release ceiling, while class-separation results depend strongly on the evaluation denominator and score construction. They also document uncertainty from clustered replay and show that balanced role recoloring is necessary for hidden-destination performance.

  • B.4 High-density dynamic result with uncertainty and cost: Table 10 fixes the high-multiplier operating point at mC = 11.553 using fresh-group attacks without padding and conditional iid k256 legal-control grouping.All four legal-control groupings have the same point estimates in this cell, and the table reports 10,000-replicate 95% intervals.
  • B.4 High-density dynamic result with uncertainty and cost: 0.994 percentage points is the maximum outer-ASR change from transferred padding across paired cells, despite up to 45.35 padding requests per campaign.The transferred modal profile changes outer ASR by more than 10−12 in only 4 of 720 cells.
  • B.4 High-density dynamic result with uncertainty and cost: 99.8% attack success is achieved when the attacker receives every release probability, while Thompson sampling reaches 99.4% across 3,072 dynamic cells.The fixed-profile baseline has median ASR 47.2% at one attempt; Thompson sampling lands within one percentage point of known-release performance in 92.5% of cells.
  • B.5 Class separation and denominator sensitivity: βall uses 4.99% capability share in the outer static replay and 0.061% in the outer dynamic replay, a denominator difference by a factor of over 80.The ratio ρ is attack-request block rate divided by matched-control block rate.
  • B.5 Class separation and denominator sensitivity: 1.1201 [1.044, 1.200] and 1.2283 [1.098, 1.347] are the two intervals excluding one, for the structured accumulator and cumulative monitor respectively.The cumulative monitor’s interval is on the outer cohort with matched-control denial 64.727%.
  • B.5 Class separation and denominator sensitivity: 19 clusters, rather than 1,275,392 matched-control events, determine the main-evaluation intervals because 2,491 records were replayed 512 times.The intervals therefore describe between-cluster heterogeneity under repeated replay of a fixed bank.
  • B.6 What the scores separate: 0.4698 against ordinary background and 0.2480 against matched controls are the released M3 intent-encoder scores on the main evaluation split.The measurements use 81 canonical decomposition requests, 2,491 test controls, and 720,000 background test rows, averaged over eight traffic orders.
  • B.6 What the scores separate: ρ = 1.037 on hidden answer destinations requires balanced role recoloring, whereas lexical scoring alone separates the canonical source class from controls at 0.9999.The result identifies balanced role recoloring as load bearing for the hidden-destination distinction.

B.7 Why the retrieval baseline reaches no operating point … B.10 Operation sharing and generator provenance

The repaired retrieval baseline restores capability-related separation but still has no admissible operating point because score saturation prevents blocking without violating utility caps. Across budget sensitivity, positive controls, operation sharing, and generator changes, the results show limited practical improvement under the tested constraints.

  • B.7 Why the retrieval baseline reaches no operating point: The repaired encoder raises capability separation against ordinary background to 0.7824 [0.760, 0.805], while canonical-versus-control separation remains 0.4961 [0.474, 0.516].Attacker-model variants have separation 0.4949 [0.467, 0.522], and both source-class intervals cover 0.5.
  • B.7 Why the retrieval baseline reaches no operating point: Despite repair, block rate is 0.0000 on canonical requests, matched controls, and attacker-model variants because causal top-one similarity reaches 0.999 or above for 100% of canonical requests and 99.96% of controls.Score saturation leaves no usable decision-statistic range at any threshold respecting the caps.
  • B.7 Why the retrieval baseline reaches no operating point: A matched-control cap alone permits blocking 43% to 63% of ordinary background traffic, so deployment requires the conjunction of matched-control and background caps.The background cap is 0.5%, while matched-control denial is capped at 1%.
  • B.8 Budget sensitivity on defense-unseen families: Across matched-control budgets from 0.25% to 10%, post hoc best-of-class ASR falls from 97.17% to 32.28%, while the best strictly admissible realizable frontier falls from 99.06% to 67.96%.Relaxing the budget therefore widens the realizable gap on defense-unseen families.
  • B.9 Cell-level positive control: At R = 2, M8 averages 98.88% over admissible cells versus 95.73% over all cells because one sparsest-control cell is excluded.The positive control uses six nested control levels with realized multipliers from 1.0000 to 26.7531.
  • B.10 Operation sharing and generator provenance: Sharing 80% of operations reduces the cost of disrupting every task from 17.54% of controls without sharing to 13.41%, with covering values computed over 91 tasks and 365 operations.Pairwise merging charges the merged operation the larger control multiplicity and lowers defender cost monotonically by a bounded amount.
  • B.10 Operation sharing and generator provenance: Of 11,393 main-cohort controls, 11,172 use DeepSeek and 221 use two local Qwen checkpoints; 206 of 365 operations contain controls from multiple backends.The control bank records each variant’s generator for the separability analysis.
  • B.10 Operation sharing and generator provenance: Switching retry generators does not make blocking easier: four judges score backend identity within 0.074 of chance, while surface scorers and the retrieval encoder find the alternative backend less suspicious.The 221 alternative-backend controls are a small sample, so the result bounds rather than removes shared-pipeline effects.

B.11 What the attacker’s own decoys show about role exchangeability … B.18 Expanded scope qualifications

The expanded analyses test attacker-controlled decoys, template removal, threshold calibration, exact-operation policies, causal costs, transcript augmentations, and evidence scope. They find persistent confounds and costs, while emphasizing that conclusions remain conditional on the evaluated partitions, models, histories, and executable contracts.

  • B.11 What the attacker’s own decoys show about role exchangeability: B.11: 347 attacker-local variants, including 296 newly certified records, remove generator provenance without evaluator recoloring but do not establish formal role exchangeability.The enlarged group expands from 51 to 347 records; attacker-written decoys make provenance constant within the attack role class.
  • B.12 Deleting the shared construction template: B.12: Removing the shared background block and trailing instruction leaves 2,568 of 2,572 records structurally aligned while preserving the evaluation pipeline.The ablation reuses the same scorers, prompts, prefix membership, clipping, retrieval, model revision, and eight-seed aggregation.
  • B.13 Re-solving thresholds on the outer families: B.13: Re-solving thresholds reveals a 43.22% ASR at 24.70% denial for the factored ledger and a pooled ratio median of 1.028 across 1,381 points.The cumulative monitor is an exception, with median ratio 1.598 and no admissible point; the exact global accumulator costs βall = 0.0155% at zero ASR.
  • B.14 Measured M9 configurations: B.14: The exact global-ledger configuration achieves 0.0000% abstract ASR in all 108 cells but incurs 22.34% pooled matched-control denial.Across cells, denial ranges from 21.6% to 25.9%, using 2,167 deduplicated matched controls.
  • B.15 The price of causal permissiveness: B.15: Online causal cost is 22.337% versus 17.595% offline, a 1.2695 premium; at q = 1.0, the corresponding premium is 1.3056.The q = 1.0 comparison uses all 2,167 controls and taskwise minimum cost sum D = 371; the 17.537% Section 6 value has a different denominator.
  • B.16 Transcript-derived augmentations do not reveal coalitions: B.16: Under the stated exchangeability conditions, transcript-derived augmentations cannot improve the exact attribution frontier beyond an O-only randomized policy.The equivalence applies when ledgers depend on S only through the ALLOW/BLOCK trace; identity, provenance, execution traces, or trusted outcomes can violate the conditions.
  • B.17 Result inventory: B.17: Independent replays reproduce the paper’s closed forms within stated tolerances, including 0.00508 against a 0.00836 frozen Monte Carlo tolerance and 5.69×10−14 for the aggregate linear program.The result inventory reports agreement between closed forms and independent replays across the principal defense calculations.
  • B.18 Expanded scope qualifications: B.18: The evidence is conditional sensitivity analysis, with main results representing in-distribution mechanism evidence and outer families measuring defense-level transfer rather than natural prevalence.The feedback theorem and experiments assume finite profiles, stationary resettable release laws, and bounded retry; construct validity relies on frozen executable contracts and researcher review.
Loading 2608.17445v1…