Pith. sign in

REVIEW 1 major objections 5 minor 40 references

Multi-agent LLM systems leak private state through internal messages even when public outputs look safe; this paper claims a typed disclosure protocol with enforceable scopes reduces worst-attacker excess accuracy from 0.326 to 0.035 while

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

MNC binds LLM-agent disclosures to recipient, purpose, lifetime, logging, memory, and forwarding scopes, and its monitor enforces them, cutting excess inference leakage from internal agent channels.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection A well-scoped, honestly evaluated proposal for enforceable disclosure scopes in LLM agents, with the main caveat that the reported frontier depends on the hand-authored candidate family and no artifacts are released. the 1 major comments →

arxiv 2608.01719 v1 pith:ORWDXYUI submitted 2026-08-03 cs.CR cs.AI

MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication

Jinghan Xu , Longze Fan , Zeyuan Wang , Xinjin Li , Hankai Liu This is my paper
classification cs.CR cs.AI
keywords multi-agent LLM privacysemantic declassificationminimum-necessary communicationreference monitorscope enforcementinternal-channel leakageinference-leakage budgetprivacy-utility frontier
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that privacy in multi-agent LLM systems is not just about what text is generated, but about what a legitimately informed agent may disclose and how that disclosure may be reused downstream. It introduces Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient, low-risk disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes, enforced by a reference monitor. The central empirical claim is that, under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. In three-backbone runs, MNC-C reduces worst-attacker excess accuracy from 0.326 (raw) and 0.063 (semantic declassifier) to 0.035, while raising task success from 0.373 and 0.325 to 0.567.

Core claim

The paper's central claim is that private multi-agent LLM communication should be treated as typed semantic declassification rather than text sanitization. MNC lets an application specify a candidate family of possible disclosures, a validator that checks whether a disclosure is sufficient for the receiver's task, and a risk model; the protocol emits the lowest-risk sufficient candidate as a scoped object carrying purpose, recipient, allowed fields, forwarding scope, lifetime, logging permission, and memory policy, with a reference monitor enforcing those scopes on every subsequent message, tool call, log write, and memory read. Under identical receipt text, MNC preserves authorized delivery

What carries the argument

The load-bearing object is the typed disclosure contract c = (p, r, F, ℓ, ϕ, µ): authorized purpose p, recipient r, allowed fields F, lifetime ℓ, permitted downstream sinks ϕ, and memory permission µ. Candidate disclosures from the application-authored family D_c are filtered by a task-sufficiency validator and ranked by risk R(d; H_t, Z); the emitted object carries its contract, and a reference monitor re-checks recipient, purpose, fields, channel, and expiration on every downstream operation, with derived objects unable to broaden scope (F′ ⊆ F, ϕ′ ⊆ ϕ, ℓ′ ≤ ℓ, µ′ ≤ µ). MNC-L adds a cumulative risk ledger with per-event threshold ε_t and budget B, charging each disclosure by the calibrated

Load-bearing premise

The privacy–utility results assume the application-authored candidate family D_c contains, for each legitimate communication, a task-sufficient candidate whose risk score is low enough to pass the validator and budget gate; if the family omits the safe receipt, MNC must delegate, abstain, or seek approval, and the reported frontier does not hold.

What would settle it

Construct a version of the entangled benchmark where, for a random half of cases, the selected_slot and completion-receipt generators are removed from D_c while keeping the task otherwise identical. If MNC-C still keeps worst-attacker excess accuracy near 0.035 without a large rise in abstention or delegation, the claim that minimum necessity is defined relative to the authored family is not doing the work; if excess rises or task success collapses, the claim is supported.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Internal agent channels can be evaluated independently of public output through excess attacker accuracy; MNC's measurements make trajectory-level leakage an explicit quantity rather than an incidental failure.
  • Content rewriting alone is not a substitute for policy: holding receipt text fixed, a text-only semantic declassifier incurs 0.999 secondary-use violations whereas MNC-C incurs 0.004, so downstream scope enforcement is the independent contribution.
  • A constrained, application-authored candidate interface supplies most of the first-disclosure privacy gain (a receipt-only oracle also reaches 0.035 excess), meaning the selection interface, not just the risk ranker, is what keeps the first hop safe.
  • A cumulative disclosure budget traces a monotone privacy–utility frontier through B = 1.0, with B = 2.0 Pareto-dominated; operators can choose an operating point (B = 0.5 here) rather than accept an implicit trade.
  • When private evidence is genuinely entangled with the task, delegation to a trusted broker (MNC-L+D) recovers task success to 0.804 with forbidden exposure 0.016, at a publicly recorded delegation rate rather than silently counting failure as success.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's claims: generalizing from these benchmarks, MNC reframes agent privacy as an interface-design problem—the burden shifts to application authors to write candidate families and validators, and the privacy guarantee is only as strong as that authored interface (the paper's own stated boundary).
  • If MNC's scope-enforcement result transfers, per-message redaction and prompt-level privacy controls should be viewed as complementary to access control: combining source-level information-flow control with scoped disclosure addresses both who can read a secret and what derived facts may be said.
  • A testable extension is to standardize MNC's typed contract as an exchange object between independently developed agents, turning privacy into a composable property of multi-agent protocols rather than a property of each model's prompting.
  • The Pareto-dominated B = 2.0 result hints at an operational rule: beyond some budget, extra disclosure buys no task utility, so leakage budgets should be tuned on the task-success plateau rather than at the privacy cliff.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

1 major / 5 minor

Summary. The paper introduces Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol for multi-agent LLM systems. An application specifies a candidate family D_c, a task-sufficiency validator, and a disclosure-risk model; MNC selects the lowest-risk sufficient candidate and binds it to a contract c=(p,r,F,ℓ,ϕ,μ) covering purpose, recipient, fields, lifetime, downstream sinks, and memory policy. A reference monitor enforces these scopes on subsequent messages, tool calls, forwarding, logs, and memory accesses, with a history-aware extension (MNC-L) adding a cumulative risk budget and a delegation path (MNC-D) for no-safe-candidate cases. The evaluation combines controlled semantic-join, memory, probing, and longitudinal diagnostics with three-backbone MAGPIE trajectories. The headline result is that MNC-C reduces worst-attacker excess accuracy from 0.326 (raw) and 0.063 (semantic declassifier) to 0.035 while raising task success to 0.567, and that under identical receipt text MNC enforces forwarding, logging, storage, and expiration restrictions that a text-only declassifier cannot.

Significance. If the reported results hold, MNC is a useful and practically motivated step beyond content-level redaction and access control: it defines an explicit interface by which an application can declare what should be disclosed and how that disclosure may be reused downstream. The evaluation is unusually controlled for a systems/privacy paper: template-disjoint attacker splits, five complementary attackers, paired cluster-bootstrap intervals, matched receipt text in the scope comparison, and explicit evidence boundaries separating end-to-end MAGPIE results from diagnostics. The paper also honestly separates delegation/abstention from ordinary task success and reports a budget sweep rather than a single operating point. These strengths make the empirical claims more credible than typical agent-privacy measurements. The main weakness is that the utility side of the central privacy–utility claim is conditional on application-authored candidate families whose coverage is not independently measured.

major comments (1)
  1. [Table 3, 'Cumulative Budgets'] The claim that B=2.0 is 'Pareto dominated' is based on a task-success difference of 0.565 vs. 0.567 at B=1.0, with no confidence interval or significance test reported for this pairwise comparison. Because the difference is within noise range, the statement should be either supported with paired bootstrap intervals or softened to 'no further task improvement observed.' This does not change the main privacy–utility conclusion, but the current phrasing overstates the evidence for the frontier shape.
minor comments (5)
  1. [Affiliation line] Typo: 'Columnbia University' should be 'Columbia University.'
  2. [Figure 1] Typo: 'Transcipt' should be 'Transcript'; the figure caption also has inconsistent capitalization.
  3. [Figure 2] Typo: 'blocked by scoepe' should be 'blocked by scope'; also 'Forwarding contolled' should be 'Forwarding controlled.'
  4. [Abstract/Introduction] The abstract says 'Three-backbone MAGPIE executions' but the text refers to 'two-backbone' in the reader's summary? The paper itself consistently says three-backbone; please ensure the terminology is consistent throughout.
  5. [Sec. 'Evaluation Setup'] The reader may be confused by 'reference monitor' appearing as a policy in Table 1 and as a component of MNC. Consider renaming the policy to 'scope-only monitor' to clarify that it enforces scopes without MNC's content selection.

Circularity Check

1 steps flagged

Minor by-construction element in the scope-enforcement demonstration; the main leakage and utility results are independent and not circular.

specific steps
  1. self definitional [Section 'Minimum-Necessary Communication', 'Contracts and enforcement' (Eqs. 3–5); Table 2 'Scopes Add Enforcement Beyond Rewriting']
    "Before releasing d, the reference monitor checks its recipient, purpose, fields, channel, and expiration time. Forwarding requires the next sink to be included in ϕ, while a memory write requires µ=1. ... MNC-C lowers violation to 0.004 while retaining 0.996 legitimate delivery success."

    The measured scope-violation rate is not an independent empirical discovery but the operational definition of MNC: any forwarding, logging, storage, or post-expiry retrieval that violates contract c or the scope constraints is rejected by the monitor by construction. Thus Table 2's demonstration that MNC blocks these operations confirms the implementation against its own specification rather than testing a prediction. This is a self-definitional element, but it is confined to the secondary-use/conformance axis. The headline task-success and worst-attacker-excess numbers in Table 1 come from full three-backbone MAGPIE runs with template-disjoint attackers and paired bootstrap, and are not entailed by the monitor definition alone; they depend on the candidate family D_c, the validator, and t

full rationale

The paper's central claims are the privacy–utility frontier in Table 1 and the scope-enforcement comparison in Table 2. The latter is partly by construction: MNC is defined as a reference monitor that checks recipient, purpose, fields, channel, forwarding, logging, lifetime, and memory permissions (Eqs. 3–5), so near-zero scope violations are a specification property, not a derived prediction. I flag this as a minor self-definitional element. It does not undermine the main results, because the leakage reduction (worst-attacker excess 0.326 -> 0.035) and task success (0.567) are measured in full multi-agent trajectories with independent attackers, template-disjoint splits, and paired bootstrap resampling. Those numbers are not derivable from the monitor's definition alone. The paper is also explicit that minimum necessity is relative to the application-authored candidate family D_c and that it 'does not assume that a model can discover the globally optimal disclosure'; this is a stated modeling assumption and a limitation, not a circular reduction. No load-bearing self-citation chain appears: references point to external benchmarks and prior systems, and no uniqueness theorem is imported from the authors. Overall, the paper is self-contained against external benchmarks; the only circular-adjacent step is the tautological enforcement demonstration, which warrants a low score rather than a serious circularity finding.

Axiom & Free-Parameter Ledger

2 free parameters · 5 axioms · 0 invented entities

The central claim rests on several domain assumptions: a trusted mediating monitor, a complete-enough candidate family, a calibrated risk model, and a faithful typed event representation. These are stated or implied in the problem setting. The paper has no fitted constants in a derivation, but the risk estimator calibration and budget thresholds are selected on development data.

free parameters (2)
  • Risk estimator calibration parameters = not disclosed
    R(d; H_t, Z) is calibrated on the development split and frozen; reported leakage depends on this fit.
  • Per-event threshold epsilon_t and cumulative budget B = B from {0.1, 0.2, 0.5, 1.0, 2.0}; B=0.5 chosen as balanced
    These thresholds set the privacy-utility trade-off and are selected on development data rather than derived.
axioms (5)
  • domain assumption The reference monitor mediates every relevant communication boundary, and contract issuance is trusted.
    The guarantee only applies to mediated channels; the paper states this in the problem setting: 'We assume that the communication boundaries considered in this work are mediated by the reference monitor.'
  • domain assumption The application-authored candidate family D_c contains a sufficient safe disclosure for each task that is attempted.
    Minimum necessity is defined relative to D_c; the paper says it 'does not assume that a model can discover the globally optimal disclosure,' so completeness of D_c is load-bearing and user-supplied.
  • domain assumption The disclosure-risk model R(d; H_t, Z) can be calibrated without access to protected labels and generalizes to unseen attackers and templates.
    The protocol 'does not require access to protected labels at deployment time,' so the paper must assume the risk estimator is a valid proxy for true disclosure risk.
  • domain assumption LLM agent operations can be faithfully represented as typed events e=(s,r,p,ch,d,t) and contracts c=(p,r,F,l,phi,mu).
    The monitor's enforcement is defined over this representation; if agent tool use or memory behavior escapes this event model, the enforcement claims do not apply.
  • domain assumption The evaluated attacker ensemble is representative of real inference threats.
    The paper says 'All privacy claims remain relative to the evaluated ensemble,' so the correctness of privacy numbers depends on that ensemble.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication." pith.science (2026). https://pith.science/paper/ORWDXYUI

@misc{pith2026260801719,
  author       = {Pith},
  title        = {Pith review of: MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ORWDXYUI}},
  note         = {Machine review of arXiv:2608.01719}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream. We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes. A reference monitor enforces these scopes across subsequent operations, while a history-aware extension accounts for inference risk accumulated over repeated disclosures. Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal. Under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. Two-backbone MAGPIE executions further show that mediated disclosures propagate through subsequent planning, tool use, coordination, and memory retrieval. These results support scope-bound semantic declassification as a practical communication boundary for private LLM-agent systems.

Figures

Figures reproduced from arXiv: 2608.01719 by Hankai Liu, Jinghan Xu, Longze Fan, Xinjin Li, Zeyuan Wang.

Figure 1
Figure 1. Figure 1: Privacy leakage through internal agent communi [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: MNC compiles private state into a task-sufficient, scoped disclosure. MNC-C selects under the current contract; [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Supplementary evidence integrated into the main paper. (a) The MNC-L budget sweep traces the observed privacy– [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

40 extracted references · 24 canonical work pages

  1. [1]

    Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education

    Clancey, William J. Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education. Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83)

  2. [2]

    Classification Problem Solving

    Clancey, William J. Classification Problem Solving. Proceedings of the Fourth National Conference on Artificial Intelligence

  3. [3]

    , title =

    Robinson, Arthur L. , title =. 1980 , doi =. https://science.sciencemag.org/content/208/4447/1019.full.pdf , journal =

    1980

  4. [4]

    New Ways to Make Microcircuits Smaller---Duplicate Entry

    Robinson, Arthur L. New Ways to Make Microcircuits Smaller---Duplicate Entry. Science

  5. [5]

    Clancey and Glenn Rennels , abstract =

    Diane Warner Hasling and William J. Clancey and Glenn Rennels , abstract =. Strategic explanations for a diagnostic consultation system , journal =. 1984 , issn =. doi:https://doi.org/10.1016/S0020-7373(84)80003-6 , url =

    doi:10.1016/s0020-7373(84)80003-6 1984

  6. [6]

    and Rennels, Glenn R

    Hasling, Diane Warner and Clancey, William J. and Rennels, Glenn R. and Test, Thomas. Strategic Explanations in Consultation---Duplicate. The International Journal of Man-Machine Studies

  7. [7]

    Poligon: A System for Parallel Problem Solving

    Rice, James. Poligon: A System for Parallel Problem Solving

  8. [8]

    Transfer of Rule-Based Expertise through a Tutorial Dialogue

    Clancey, William J. Transfer of Rule-Based Expertise through a Tutorial Dialogue

  9. [9]

    The Engineering of Qualitative Models

    Clancey, William J. The Engineering of Qualitative Models

  10. [10]

    2023 , eprint=

    Attention Is All You Need , author=. 2023 , eprint=

    2023

  11. [11]

    Pluto: The 'Other' Red Planet

    NASA. Pluto: The 'Other' Red Planet

  12. [12]

    AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for

    Debenedetti, Edoardo and Zhang, Jie and Balunovic, Mislav and Beurer-Kellner, Luca and Fischer, Marc and Tram. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for. The Thirty-eighth Conference on Neural Information Processing Systems Datasets and Benchmarks Track , year=

    work page

  13. [13]

    Communications of the ACM , volume=

    A Lattice Model of Secure Information Flow , author=. Communications of the ACM , volume=

    work page

  14. [14]

    AgentLeak: A Full-Stack Benchmark for Privacy Leakage in Multi-Agent

    El Yagoubi, Faouzi and Badu-Marfo, Godwin and Al Mallah, Ranwa , journal=. AgentLeak: A Full-Stack Benchmark for Privacy Leakage in Multi-Agent

    work page

  15. [15]

    Information-Theoretic Privacy Control for Sequential Multi-Agent

    Asif, Sadia and Mohammadi Amiri, Mohammad , journal=. Information-Theoretic Privacy Control for Sequential Multi-Agent

    work page

  16. [16]

    Securing

    Costa, Manuel and K. Securing. arXiv preprint arXiv:2505.23643 , year=

    Pith/arXiv arXiv

  17. [17]

    arXiv preprint arXiv:2505.04799 , year=

    Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems , author=. arXiv preprint arXiv:2505.04799 , year=

    Pith/arXiv arXiv

  18. [18]

    ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using

    Hu, Shijing and Liu, Liang and Meng, Zhu and Zhao, Zhicheng , journal=. ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using

    work page

  19. [19]

    18th IEEE Computer Security Foundations Workshop , pages=

    Dimensions and Principles of Declassification , author=. 18th IEEE Computer Security Foundations Workshop , pages=. 2005 , doi=

    work page 2005

  20. [20]

    Xie, Jin and Li, Songze , journal=

    work page

  21. [21]

    Zharmagambetov, Arman and Guo, Chuan and Evtimov, Ivan and Pavlova, Maya and Salakhutdinov, Ruslan and Chaudhuri, Kamalika , journal=

  22. [22]

    , journal=

    Zou, Chelsea and Yao, Yiheng and She, Selena and Hawkins, Robert D. , journal=. CalBench: Evaluating Coordination-Privacy Trade-offs in Multi-Agent

    work page

  23. [23]

    ACM Transactions on Computer Systems , volume=

    TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones , author=. ACM Transactions on Computer Systems , volume=

    work page

  24. [24]

    Juneja, Gurusha and Pasupulati, J. N. S. and Albalak, Alon and Hua, Wenyue and Wang, William Yang , journal=

    work page

  25. [25]

    Washington Law Review , volume=

    Privacy as Contextual Integrity , author=. Washington Law Review , volume=

    work page

  26. [26]

    Proceedings of the IEEE , volume=

    The Protection of Information in Computer Systems , author=. Proceedings of the IEEE , volume=

    work page

  27. [27]

    Unveiling Privacy Risks in

    Wang, Bo and He, Weiyi and He, Pengfei and Zeng, Shenglai and Xiang, Zhen and Xing, Yue and Tang, Jiliang , journal=. Unveiling Privacy Risks in

    work page

  28. [28]

    and White, Ryen W

    Wu, Qingyun and Bansal, Gagan and Zhang, Jieyu and Wu, Yiran and Li, Beibin and Zhu, Erkang and Jiang, Li and Zhang, Xiaoyun and Zhang, Shaokun and Liu, Jiale and Awadallah, Ahmed H. and White, Ryen W. and Burger, Doug and Wang, Chi , journal=. AutoGen: Enabling Next-Gen

    work page

  29. [29]

    International Conference on Learning Representations , year=

    ReAct: Synergizing Reasoning and Acting in Language Models , author=. International Conference on Learning Representations , year=

  30. [30]

    Agent Security Bench (

    Zhang, Hanrong and Huang, Jingyuan and Mei, Kai and Yao, Yifei and Wang, Zhenting and Zhan, Chenlu and Wang, Hongwei and Zhang, Yongfeng , booktitle=. Agent Security Bench (

    work page

  31. [31]

    AgentBench: Evaluating

    Liu, Xiao and Yu, Hao and Zhang, Hanchen and Xu, Yifan and Lei, Xuanyu and Lai, Hanyu and Gu, Yu and Ding, Hangliang and Men, Kaiwen and Yang, Kejuan and Zhang, Shudan and Deng, Xiang and Zeng, Aohan and Du, Zhengxiao and Zhang, Chenhui and Shen, Sheng and Zhang, Tianjun and Su, Yu and Sun, Huan and Huang, Minlie and Dong, Yuxiao and Tang, Jie , booktitle...

    work page

  32. [32]

    Identifying the Risks of

    Ruan, Yangjun and Dong, Honghua and Wang, Andrew and Pitis, Silviu and Zhou, Yongchao and Ba, Jimmy and Dubois, Yann and Maddison, Chris and Hashimoto, Tatsunori , booktitle=. Identifying the Risks of

    work page

  33. [33]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=. 2024 , doi=

    work page 2024

  34. [34]

    arXiv preprint arXiv:2312.14197 , year=

    Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models , author=. arXiv preprint arXiv:2312.14197 , year=

    Pith/arXiv arXiv

  35. [35]

    Zheng, Qiaoyuan and Yang, Yiqu and Gao, Qi and Schlag, Imanol , journal=

    work page

  36. [36]

    Prompt Flow Integrity to Prevent Privilege Escalation in

    Kim, Juhee and Choi, Woohyuk and Lee, Byoungyoung , journal=. Prompt Flow Integrity to Prevent Privilege Escalation in

    work page

  37. [37]

    Proceedings of the Sixteenth ACM Symposium on Operating Systems Principles , pages=

    A Decentralized Model for Information Flow Control , author=. Proceedings of the Sixteenth ACM Symposium on Operating Systems Principles , pages=. 1997 , doi=

    work page 1997

  38. [38]

    and Stoica, Ion and Gonzalez, Joseph E

    Packer, Charles and Wooders, Sarah and Lin, Kevin and Fang, Vivian and Patil, Shishir G. and Stoica, Ion and Gonzalez, Joseph E. , journal=. MemGPT: Towards

    work page

  39. [39]

    International Conference on Learning Representations , year=

    LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory , author=. International Conference on Learning Representations , year=

    work page

  40. [40]

    30th USENIX Security Symposium , pages=

    Extracting Training Data from Large Language Models , author=. 30th USENIX Security Symposium , pages=

    work page

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.