{"id":"cf4e5842-d644-4805-af58-c6a2b63f6159","arxiv_id":"2608.10509","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"MAP-Graph combines permission filtering, ancestry-based trust scoring, and action-time gating for shared agent memory, reporting 94.96% task success, 72.70% exact accuracy, and 0% observed unauthorized access on a 2,700-task synthetic benchmark.","lead":"This paper describes MAP-Graph, a memory layer that records where each piece of agent information came from, blocks records an agent may not use, and re-checks evidence before risky actions. In a controlled synthetic benchmark it reports high task success with zero observed leaks, while stressing that the tests are not deployment-scale.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline numbers are only as strong as the undisclosed oracle label rule; without it, exact accuracy and safety rates may partly encode MAP-Graph's own policy.","rationale":"The reader's weakest_assumption names the oracle label-generation rule and the hand-set constants; I agree that the oracle rule is the primary hinge. The central claim is that provenance is an operational control signal, not just audit metadata. This is a feasibility claim, and the paper is careful to scope it to the synthetic setting. However, the evidence for the claim is almost entirely the Table 1 and Table 2 numbers, and those numbers are denominated by oracle labels. Without knowing how labels were created, the reader cannot distinguish (a) MAP-Graph implements an independently sensible admissibility policy and matches it, from (b) MAP-Graph's deterministic rules were used to generate the labels, making exact accuracy a consistency check. The latter would not falsify the mechanism's feasibility, but it would substantially weaken the empirical support for generalization. The ablations, especially the permission-filter ablation showing UAcc at 100% when filtering is removed, provide direct evidence of access enforcement that is less dependent on oracle labels, and I credit that. This is why the appropriate outcome remains CONDITIONAL (as the reader had it) rather than REJECT: the missing rule is a condition on the evidence, not a demonstrated flaw in the mechanism. I would not move the verdict because the reader already identified the same condition; hence UNCHANGED relative to their conditional verdict.","tokens_in":18923,"tokens_out":5227,"duration_ms":53655,"concrete_test":"Release the oracle-generation code or a precise, formal label rule for Appendix C, and recompute Table 1 on a held-out set of 450 tasks per risk group whose labels are produced by an independent process that does not consume the same visibility, ownership, risk, and trust fields used by MAP-Graph's CanRead and gate rules (for example, a human-authored rubric or a second implementation with a different decision structure). If Acc and the safety metrics are unchanged, the concern is resolved; if exact accuracy drops materially or any ASR, leakage, or revocation violations appear, the headline numbers were partly encoding the target policy.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Every headline number in Table 1 is defined relative to the oracle labels (Section 4.1 and Appendix C), and the paper's strongest claim — that recorded lineage can operationalize admissibility — rests on the exact-accuracy and safety metrics. Appendix C describes task construction and sanitization but never states how the 960 Allow, 1,140 Block, 210 Reverify, and 390 Redact labels were generated. The sanitizer removes the \"oracle decision, evaluator rationale, experiment and family identifiers, variant metadata, the top-level evaluator canary annotation, and every should_be_used annotation\" before agents run, but the rule that produced those labels is not given, and no code or data are released. If the labels were produced by a deterministic rule over the same risk, visibility, ownership, trust, and revocation fields that MAP-Graph's CanRead, path-trust, and action-gate rules consume, then high exact accuracy and 0% ASR, leakage, and revocation violations partly verify that MAP-Graph implements the label generator's own policy, not that it discovered an independent admissibility criterion. The paper is appropriately scoped and its permission-filter ablation is informative, but the central empirical support is unverifiable as published. A second, reinforcing gap is that the hand-set constants (Appendix A.1 and Section 3.4) have no sensitivity analysis, so even the observed numbers are single-point estimates; this is secondary to the oracle issue.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents MAP-Graph, a provenance-aware shared-memory layer for multi-agent LLM workflows. MAP-Graph represents agents, sources, memories, claims, and actions in a typed execution graph; at retrieval it applies a hard permission filter, then reranks eligible memories by semantic similarity times a multiplicative path-trust score computed from recorded ancestry, and finally applies a risk-sensitive action-time gate that can return Allow, Block, Reverify, Redact, or AskUser. The evaluation is a controlled synthetic benchmark of 2,700 tasks across three domains, with seven baselines, six ablations, and a three-backbone transfer subset. The headline results are 94.96% task success, 72.70% exact decision accuracy, and 0% observed ASR, leakage, and revocation violations, with the caveat that these are single-run temperature-0 results. The paper argues that provenance can serve as an operational control signal rather than only post-hoc audit metadata.","tokens_in":19269,"tokens_out":3213,"duration_ms":33094,"significance":"If the results hold, the paper makes a useful contribution: it cleanly separates hard authorization from graded trust, introduces an action-indexed gate that addresses a real limitation of retrieval-only policies, and its access-boundary metrics (UAcc, leakage, revocation) are more informative than utility-only evaluation. The appendix documentation is unusually detailed for the architecture and operation semantics, and the ablations (especially the no-permission-filter variant, where utility rises while unauthorized access jumps to 100%) give concrete evidence that aggregate utility can mask access-control failures. The main empirical claim, however, is only as strong as the undisclosed oracle-labeling rule and the unexamined hand-set constants; as published, the central evaluation is not fully verifiable.","major_comments":[{"comment":"The oracle label-generation rule is not documented. The benchmark is described as having 960 Allow, 1,140 Block, 210 Reverify, and 390 Redact labels, and the sanitizer removes the 'oracle decision, evaluator rationale, experiment and family identifiers, variant metadata, the top-level evaluator canary annotation, and every should_be_used annotation' before agents run, but Appendix C never states the rule that produced these labels from the task fields. Since Acc, TSR, Unsafe, ASR, Leakage, and Revocation are all computed relative to these labels, the readers cannot determine whether the labels encode an independent admissibility criterion or are generated by a rule that consumes the same visibility, ownership, trust, risk, and revocation fields that MAP-Graph's deterministic rules consume. Please state the exact label-generation rule, or better, release the generator code and data, and confirm that the rule was not derived from MAP-Graph's own scoring or thresholds.","section":"Section 4.1 and Appendix C"},{"comment":"The hand-set constants and thresholds are load-bearing but receive no sensitivity analysis. The gate thresholds (0.30 for answers, 0.60 for low/medium risk, 0.85 for high risk), the path-integrity penalties (0.25, 0.45, 0.15), transformation losses, verification bonus, and default source trust and writer reliability (0.80, 0.95) enter directly into the multiplicative trust score and the gate decisions. The headline 0% ASR, leakage, and revocation, and even the 94.96% TSR, are single-point estimates evaluated at one manually chosen parameter vector. Please report a sensitivity sweep over these parameters (at least the gate thresholds and the main integrity penalties) to show that the safety and utility conclusions are not knife-edge artifacts of the chosen values.","section":"Section 3.4 and Appendix A.1"},{"comment":"The empirical claims rest on a single temperature-0 run, and the reported confidence intervals are cluster-bootstrap intervals over semantic families within that fixed run, not over inference nondeterminism. The paper acknowledges this, but the central claim that provenance 'can be an operational control signal' is supported by point estimates from a single seed and a single run of each method. Since remote API calls at temperature 0 can still exhibit sampling nondeterminism and token-cap truncations (3.89–9.08% of calls reach the cap), please provide at least a small number of repeated runs (or multiple seeds) for the main comparison and the key ablations, and report the resulting variance in the safety metrics, especially the 0% rates.","section":"Section 4.3 and Appendix E"},{"comment":"The write-time scope-intersection rule is stated as the mechanism that 'carries access restrictions into newly derived records,' but its correctness is not analyzed or tested in the scenarios where a derived memory references multiple sources with different ownership scopes, or where a source is revoked after a multi-step derivation chain. The current benchmark has one scenario class per group and a structured set of fields, so it may not exercise conflicting-scope cases or delayed revocation through deep ancestry. Please either provide a formal argument for the intersection rule with respect to the CanRead check, or add targeted tests that vary the number and conflict of referenced scopes and the depth of the derivation chain.","section":"Section 3.3"}],"minor_comments":[{"comment":"The statement 'if the final structured action cannot be parsed, the harness recovers the public action type and risk from the task schema and uses the retrieved records as support' should specify how often this fallback occurred and whether it was applied uniformly across baseline methods, since it affects the comparability of the gate inputs.","section":"Appendix C.1"},{"comment":"The backbone transfer section says MAP-Graph 'leads TSR on Qwen and Llama' but on GLM it trails B6 by 2.59 points; the accompanying text currently mentions this as a utility–safety trade-off, but a clearer statement of whether this difference is within the bootstrap interval of the subset would help the reader interpret the transfer claim.","section":"Section 4.5 / Table 3"},{"comment":"The error analysis reports 601 safe-but-non-exact interventions and 95 unnecessary interventions on allow cases; it would be helpful to add a short breakdown of how the 95 cases are distributed across the six experiment groups, since 'unnecessary intervention' on clean allow tasks is a different failure mode from a non-exact block in a poisoned task.","section":"Appendix F.6"},{"comment":"Several references have inconsistent formatting, including 'Ligh- tRAG' split across a line break and missing venue/pages details for some arXiv-only entries; please normalize the bibliography to the journal's style.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is well within the journal's scope and the architectural ideas are worth publishing, but the evaluation's cornerstone—the undisclosed oracle rule—must be addressed before the empirical claims can be trusted. I would also expect the editors to require code/data release as a condition of any acceptance, given that the benchmark is synthetic and generated programmatically. One additional point for the editor: the related work cites a very close 2026 system (Margalit et al., Governed Shared Memory), and the authors position MAP-Graph as complementary; the novelty claim should be scrutinized at revision time to ensure the contribution is not a re-implementation of that system's core mechanisms with a different evaluation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take on MAP-Graph. The paper does one thing well: it turns provenance from bookkeeping into a control signal by combining a hard permission filter, multiplicative path trust, and an action-time risk gate in a single memory layer, and tests the combination in a controlled benchmark. The ablations are genuinely informative: removing the permission filter boosts utility but lets every observed unauthorized read through; removing the gate destroys the safety numbers; trust propagation buys a few points. That is a clear, honest experimental package.\n\nThe weak point is the oracle. The headline metrics—Acc, ASR, leakage, revocation—are all computed against labels that Appendix C describes as structured but never defines. The sanitizer strips the oracle decision and the 'should_be_use' annotations before the agents run, but we never learn the rule that produced 960 Allow, 1,140 Block, 210 Reverify, and 390 Redact. If that rule consumes the same visibility, risk, ownership, trust, and revocation fields that MAP-Graph's CanRead, path-trust, and gate rules consume, then the 72.70% exact accuracy and 0% violation rates partly reflect the benchmark encoding the target policy rather than an independent generalization test. The paper doesn't claim to have an independent ground truth, but it doesn't tell us what the ground truth is, and no code or data are released to make the answer checkable. That's the thing I'd want fixed before trusting the numbers.\n\nSecond, the constants in Appendix A.1 are hand-set with no sensitivity analysis. The action-gate thresholds (0.30/0.60/0.85) and the path-integrity penalties (0.25/0.45/0.15) are free parameters, and all safety results are single-run point estimates. That's a moderate concern, not a fatal one—the paper acknowledges it's a controlled benchmark—but it means we can't tell how much of the zero-violation result rides on the specific values.\n\nThe paper is honest about its limitations: single-run, synthetic, simulated actions, one round per task, adapted baselines rather than reproductions. I believe the authors. The related work is well covered and the novelty claim is appropriately scoped.\n\nThis is a paper for people building governed memory for LLM agents. A serious referee should engage with it—the integration is real and the error analysis (the action-risk group still has 41 impermissible Allows) is useful. But I would not accept it as published without the oracle rule disclosed and ideally code and data released. The central idea holds up; the empirical support is conditional.","headline":"MAP-Graph offers a genuinely useful integration of permission filtering, path trust, and action gating for agent shared memory, but the undisclosed oracle-label rule makes the headline numbers unverifiable as published.","tokens_in":19747,"tokens_out":3110,"would_cite":true,"duration_ms":26726,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Provenance can act as an operational control signal for multi-agent shared memory, not just post-hoc audit metadata.","keywords":["multi-agent memory","provenance","shared memory","access control","LLM agents","path trust","action gating","memory safety"],"falsifier":"Systematically vary the action-gate thresholds (0.30, 0.60, 0.85) and the path-trust penalties (0.25, 0.45, 0.15), or regenerate the oracle labels with an independently stated admissibility rule; if the 0% attack-success, leakage, and revocation rates do not survive, the operational-control claim is not robust.","tokens_in":18747,"feed_emoji":"🔐","tokens_out":7086,"duration_ms":58917,"temperature":0.7,"pith_summary":"Shared memory helps language-model agents reuse information, but a relevant memory may still be inadmissible because its source was private, poisoned, untrusted, or revoked, and summaries can hide that lineage. MAP-Graph treats provenance as an operational control signal: it records each memory's ancestry in a typed execution graph, excludes permission-ineligible records before ranking, reranks survivors by semantic similarity times multiplicative path trust, and applies a risk-sensitive gate once a concrete action is proposed. On a synthetic benchmark of 2,700 tasks per method, the authors report 94.96% task success, 72.70% exact decision accuracy, and zero observed attack-success, leakage, or revocation violations. If the claim holds, shared-memory systems can enforce access and safety at retrieval and action time rather than only reconstructing who did what after the fact.","feed_headline":"Provenance can enforce shared-memory safety, not just audit it","feed_subtitle":"A provenance-aware memory layer blocks every observed unauthorized read while keeping task success at 94.96%.","key_machinery":"The central object is a typed execution-provenance graph, a heterogeneous directed graph whose nodes are agents, sources, memories, claims, and actions, and whose edges record derivation, summarization, read/write, verification, invalidation, and action use. The argument runs on the multiplicative path-trust identity $\\rho(m,a)=\\mathrm{clip}_{[0,1]}\\big(S(m)\\,I(m)\\,F(m)\\,P(m,a)\\,V(m)\\,A(m)\\big)$, combining source trust, path integrity, transformation factor, permission validity, verification bonus, and writer reliability, with final rank $\\mathrm{Score}(m,q,a)=s(m,q)\\,\\rho(m,a)$. This factorization does the load-bearing work: a binary permission filter removes candidates before ranking, while trust only scales surviving scores, so a highly similar record cannot outrank an access restriction; recursive traversal of the recorded ancestry makes multi-step restrictions visible; and a separate action-time gate, with risk-indexed thresholds, re-checks evidence once the proposed action is known. The graph is built only from observable execution traces and explicit metadata, not from private chain-of-thought.","core_discovery":"The paper's central claim is that provenance — the recorded lineage of which sources and derivations produced a memory — is sufficient to govern both retrieval and action-time admissibility, provided hard authorization is kept separate from graded trust. The proposed MAP-Graph builds a task-scoped typed execution graph with nodes for users, agents, tools, resources, messages, memories, claims, and actions, and edges for derivation, summarization, reading, writing, verification, invalidation, and action use. Retrieval first applies a binary permission check, then ranks only eligible memories by semantic similarity times a clipped multiplicative path trust that compounds penalties for untrusted, private, or revoked ancestry; an action-time re-evaluation blocks high-risk actions supported by affected memories while retaining their lineage for audit. In the evaluated synthetic setting, this reaches 94.96% task success and 72.70% exact decision accuracy with 0% observed unauthorized reads, attack success, leakage, and revocation violations across 2,700 tasks, and the exact-accuracy and access-enforcement advantages transfer across three language-model backbones. The authors frame these as single-run controlled results, not deployment-scale claims.","pith_inferences":["Inference: If the hard/graded factorization generalizes, permission-tagged documents in ordinary retrieval pipelines could be filtered before ranking using the same pattern, with restrictions inherited through derivation steps rather than only through the memory layer's own writes.","Inference: A testable extension is a sensitivity sweep of the hand-set constants; the claim that safety comes from provenance would be stronger if the 0% attack-success, leakage, and revocation rates survive modest changes to the listed thresholds and penalties.","Inference: The paper's own residual safety errors concentrate in the action-risk group, which suggests that the next lever is better risk calibration rather than more provenance detail.","Inference: The current design resets graph and vector state between tasks, so the results speak to within-task coordination; extending the same provenance machinery across sessions would require a policy for how permission scopes and trust levels compose across task boundaries."],"forward_implications":["Shared-memory systems can implement admissibility as a deterministic pipeline: permission filter, trust rerank, action gate, rather than relying on the model to infer restrictions from content.","A single memory can be admissible for a low-risk answer yet inadmissible for a high-risk external action, because the decision is re-taken with action risk in view.","Affected records need not be deleted: retaining them with their ancestry and marking them affected preserves audit evidence while blocking their use.","Evaluation of governed memory should instrument the read boundary alongside aggregate utility, because utility can rise even as unauthorized reads occur.","Exact decision quality and access enforcement can transfer across different generation backbones even when utility does not."],"supporting_citations":[{"why":"Supplies the private/shared-tier access-control baseline that MAP-Graph's permission filtering and retrieval policy extend.","marker":"Rezazadeh et al. 2025"},{"why":"Supplies the lineage-sensitive high-risk-check baseline that MAP-Graph's recursive ancestry and action-time gating extend.","marker":"Ouyang and Hou 2026"},{"why":"Supplies the trajectory-graph baseline that motivates and contrasts with typed execution-lineage construction.","marker":"Zhang et al. 2025a"},{"why":"Closest prior governed shared-memory system combining scoped retrieval, provenance tracking, and policy propagation; the paper positions its contribution against this line.","marker":"Margalit et al. 2026"},{"why":"Formalizes the derivation relations that the graph's derivation edges build on.","marker":"Moreau and Missier 2013"},{"why":"Documents the provenance-metadata specification family used to motivate recording lineage.","marker":"Missier, Belhajjame, and Cheney 2013"}],"fun_headline_variants":["Provenance gates shared memory: 0 unauthorized reads","Memory lineage as an action gate for agents","Let lineage decide what agents can read and do","MAP-Graph: provenance blocks unsafe agent actions","Shared memory that respects memory lineage"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The results stand on the assumption that the benchmark's synthetic task labels correctly define what should be allowed, together with hand-set trust and risk thresholds that the paper never varies.","fun_headline_variants_meta":{"raw":{"variants":["Provenance gates shared memory: 0 unauthorized reads","Memory lineage as an action gate for agents","Let lineage decide what agents can read and do","MAP-Graph: provenance blocks unsafe agent actions","Shared memory that respects memory lineage"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00025,"raw_usage":{"total_tokens":1597,"prompt_tokens":1029,"completion_tokens":568,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":645,"completion_tokens_details":{"reasoning_tokens":499}},"tokens_in":645,"tokens_out":568,"duration_ms":5653,"temperature":1.0,"reasoning_tokens":499,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:18:24.134223+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Systematically vary the action-gate thresholds (0.30, 0.60, 0.85) and the path-trust penalties (0.25, 0.45, 0.15), or regenerate the oracle labels with an independently stated admissibility rule; if the 0% attack-success, leakage, and revocation rates do not survive, the operational-control claim is not robust.","supporting_citations":[{"cited_title":"Collaborative Memory: Multi-User Memory Sharing in","cited_arxiv_id":null,"evidence_quote":"Supplies the private/shared-tier access-control baseline that MAP-Graph's permission filtering and retrieval policy extend."},{"cited_title":"Governed Shared Memory for Multi-Agent","cited_arxiv_id":null,"evidence_quote":"Closest prior governed shared-memory system combining scoped retrieval, provenance tracking, and policy propagation; the paper positions its contribution against this line."},{"cited_title":"2013 , url =","cited_arxiv_id":null,"evidence_quote":"Formalizes the derivation relations that the graph's derivation edges build on."}],"review_version":1}