{"paper":{"title":"Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs","arxiv_id":"2608.29028","primary_cat":"cs.AI","submitted_at":"2026-08-29T03:38:35+00:00","version_compiled":"v1"},"notice":"Every quoted sentence is the authors' text from the arXiv listing abstract. Labels and probabilities are the outputs of classifier-1.13.0 on the question bank abstract-p1-20260923, exactly as returned. No sentence in this record was written by a language model.","schema":"pith.compiled-record/v0","status":"compiled","abstract":{"source":"arXiv listing abstract v1","sentences":[{"i":0,"p":1.0,"id":"s0","own":false,"role":"background","text":"Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state.","hedge":{"p":0.87,"label":"asserted"},"own_p":0.06,"main_claim_p":0.03,"quantitative":false,"quantitative_p":0.03,"role_probabilities":{"gap":0.0,"method":0.0,"result":0.0,"background":1.0,"limitation":0.0,"future_work":0.0,"contribution":0.0,"interpretation":0.0}},{"i":1,"p":0.53,"id":"s1","own":true,"role":"contribution","text":"We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \\emph{summary collapse}.","hedge":{"p":1.0,"label":"asserted"},"own_p":0.89,"main_claim_p":0.92,"quantitative":false,"quantitative_p":0.06,"role_probabilities":{"gap":0.0,"method":0.0,"result":0.35,"background":0.0,"limitation":0.0,"future_work":0.0,"contribution":0.53,"interpretation":0.12}},{"i":2,"p":0.98,"id":"s2","own":true,"role":"method","text":"On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge ($\\kappa = 0.74$), where $\\sigma_b = 1$ means every boundary marker survives verbatim and $\\sigma_b = 0$ means all are lost.","hedge":{"p":0.97,"label":"asserted"},"own_p":0.96,"main_claim_p":0.06,"quantitative":true,"quantitative_p":0.99,"role_probabilities":{"gap":0.0,"method":0.98,"result":0.01,"background":0.0,"limitation":0.0,"future_work":0.0,"contribution":0.01,"interpretation":0.0}},{"i":3,"p":1.0,"id":"s3","own":true,"role":"result","text":"Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson $r$ near zero): uncompressed free-text handoffs preserve boundaries at $\\sigma_b \\approx 0.80$, whereas a $25$-word budget drops $\\sigma_b$ to ${\\approx}0.57$ while operational-fact survival stays near ceiling.","hedge":{"p":1.0,"label":"asserted"},"own_p":0.96,"main_claim_p":0.19,"quantitative":true,"quantitative_p":0.99,"role_probabilities":{"gap":0.0,"method":0.0,"result":1.0,"background":0.0,"limitation":0.0,"future_work":0.0,"contribution":0.0,"interpretation":0.0}},{"i":4,"p":1.0,"id":"s4","own":true,"role":"result","text":"Controlled downstream tests reveal that protection depends on \\emph{boundary explicitness}: vague languages leak in $73\\%$ of GPT and $50\\%$ of DeepSeek cases, while explicit constraints reduce leakage to under $15\\%$ across all three tested models.","hedge":{"p":1.0,"label":"asserted"},"own_p":0.94,"main_claim_p":0.14,"quantitative":true,"quantitative_p":0.99,"role_probabilities":{"gap":0.0,"method":0.0,"result":1.0,"background":0.0,"limitation":0.0,"future_work":0.0,"contribution":0.0,"interpretation":0.0}},{"i":5,"p":0.9,"id":"s5","own":true,"role":"result","text":"A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff.","hedge":{"p":1.0,"label":"asserted"},"own_p":0.94,"main_claim_p":0.05,"quantitative":true,"quantitative_p":0.74,"role_probabilities":{"gap":0.0,"method":0.02,"result":0.9,"background":0.0,"limitation":0.0,"future_work":0.0,"contribution":0.01,"interpretation":0.07}},{"i":6,"p":0.67,"id":"s6","own":true,"role":"result","text":"Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.","hedge":{"p":1.0,"label":"asserted"},"own_p":0.91,"main_claim_p":0.45,"quantitative":true,"quantitative_p":0.82,"role_probabilities":{"gap":0.0,"method":0.0,"result":0.67,"background":0.0,"limitation":0.0,"future_work":0.0,"contribution":0.01,"interpretation":0.32}}]},"compiled":{"main_claim":{"p":0.97,"text":"We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \\emph{summary collapse}.","location":"abstract s1","hedge_strength":{"p":1.0,"label":"asserted"}},"provenance":{"route":{"via":"TypeSafe API","model":"classifier-1.13.0","endpoint":"https://api.typesafe.ai/v1/systemone","provider":"TypeSafe"},"packing":"one request per paper","requests":1,"input_tokens":6083,"cost_usd_reported":0.0},"compiled_at":"2026-09-23","bank_version":"abstract-p1-20260923","model_version":"classifier-1.13.0","abstract_states":{"claims_first":0.05,"states_limitation":0.35,"human_participants":0.53,"controlled_comparison":0.98,"randomized_assignment":0.04,"states_quantitative_result":0.99,"compares_with_prior_results":0.91,"mentions_code_or_data_availability":0.03},"evidential_basis":{"p":0.99,"value":"observation or experiment","probabilities":{"argument":0.0,"literature":0.0,"proof_or_derivation":0.0,"analysis_of_existing_data":0.0,"observation_or_experiment":0.99,"simulation_or_computation":0.01}},"contribution_type":{"p":1.0,"value":"empirical study","probabilities":{"review":0.0,"method_or_tool":0.0,"empirical_study":1.0,"simulation_study":0.0,"theoretical_result":0.0,"dataset_or_benchmark":0.0,"position_or_commentary":0.0}},"contribution_statement":{"p":0.97,"text":"We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \\emph{summary collapse}.","location":"abstract s1"}},"coverage":{"tier":"abstract","levels_run":["P abstract"],"not_examined":["full text","figures and tables","references and citing sentences","relations to other papers"],"sources_read":["arXiv listing abstract v1"],"levels_not_run":["S sections","T body sentences","C citations","R cross-paper relations"],"sentences_examined":7,"sentences_in_abstract":7},"measured_accuracy":{"url":"https://pith.science/accuracy","measured_on":"2026-10-02","method":"two independent model families labelled a fresh random sample blind; the figure is how often the published label matches their consensus","sentence_role_agreement":0.92,"main_claim_agreement":0.908,"typed_citation_agreement":0.933,"typed_citation_agreement_95_interval":[0.917,0.945],"review_comments_accurate":0.758,"review_comments_accurate_95_interval":[0.684,0.82],"review_caught_admitted_error_found_or_related":0.448}}