文章背景与核心概要
随着个人语言智能体在处理多受众交互时日益普及，它们从一个受众处学到的信息可能会无意中泄漏到为另一个受众组装的提示词（prompts）中。这种“内存到上下文（memory-to-context）”的转换过程引入了严重的攻击面，包括模糊的通信通道、跨受众窥探以及受污染的内存。
为了缓解这些漏洞，本文提出了“在上下文之前授权”（Authorization Before Context）机制：这是一种直接在内存到上下文的转换过程中强制执行的单一、反单调（anti-monotone）的受众成员规则。通过受众标记、查看者集解析和严格的准入规则，该方法在模型调用之前对组装好的上下文进行边界控制。
研究结果表明，该规则在数学上确保了参与者的跨通道召回能力，同时从结构上（通过排除而非模型行为）保证了为狭隘受众记录的信息绝不会流向更广泛的受众，且受污染的内存无法被人为扩大其受众范围。实证验证显示，在合成的上下文完整性测试套件中，零个被禁事实进入了组装好的上下文，安全审计确认所有读取路径均采用默认关闭（fail-closed）策略。
Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems
Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems
Authors: Sibo Liu
Submitted: 17 August 2026
Primary Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv ID: 2608.17148
DOI: 10.48550/arXiv.2608.17148
Comments: 13 pages, 3 figures. Author preprint. Accepted for presentation at AdvML-Frontiers x CoTMA, a non-archival workshop at COLM 2026.
Authors: Sibo Liu
Submitted: 17 August 2026
Primary Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv ID: 2608.17148
DOI: 10.48550/arXiv.2608.17148
Comments: 13 pages, 3 figures. Author preprint. Accepted for presentation at AdvML-Frontiers x CoTMA, a non-archival workshop at COLM 2026.
Abstract Summary
Abstract Summary
Personal language agents that learn information from one audience risk inadvertently leaking that data into prompts assembled for another. This "memory-to-context" step introduces critical attack surfaces, including ambiguous communication channels, cross-audience prying, and poisoned memory.
Personal language agents that learn information from one audience risk inadvertently leaking that data into prompts assembled for another. This "memory-to-context" step introduces critical attack surfaces, including ambiguous communication channels, cross-audience prying, and poisoned memory.
To mitigate these vulnerabilities, this paper introduces Authorization Before Context: a single, anti-monotone audience-membership rule enforced directly at the memory-to-context transition.
To mitigate these vulnerabilities, this paper introduces Authorization Before Context: a single, anti-monotone audience-membership rule enforced directly at the memory-to-context transition.
Key Mechanisms:
- Audience Tagging: Every recorded memory item retains metadata indicating the active audience present at the time of recording.
- Viewer Set Resolution: The current viewer set is derived from channel metadata, defaulting to public visibility when ambiguous.
- Strict Admission Rule: A memory item is admitted into the context only if every current viewer already belonged to its original audience.
Key Mechanisms:
- Audience Tagging: Every recorded memory item retains metadata indicating the active audience present at the time of recording.
- Viewer Set Resolution: The current viewer set is derived from channel metadata, defaulting to public visibility when ambiguous.
- Strict Admission Rule: A memory item is admitted into the context only if every current viewer already belonged to its original audience.
Findings & Guarantees:
- Mathematical Guarantees: The authors prove that this rule provides cross-channel recall for participants while structurally ensuring (via exclusion rather than model behavior) that information recorded for a narrow audience never reaches a broader one, and that poisoned memory cannot artificially widen its audience.
- Model-Neutral Invariant: The boundary acts on the exact assembled context prior to model invocation—guaranteeing that forbidden facts are entirely absent.
- Empirical Validation: On a synthetic Contextual-Integrity suite, zero forbidden facts entered the assembled context (whereas unscoped baselines included them by construction), and security audits confirmed that all read paths fail closed. (Note: Evidence remains preliminary and synthetic).
Findings & Guarantees:
- Mathematical Guarantees: The authors prove that this rule provides cross-channel recall for participants while structurally ensuring (via exclusion rather than model behavior) that information recorded for a narrow audience never reaches a broader one, and that poisoned memory cannot artificially widen its audience.
- Model-Neutral Invariant: The boundary acts on the exact assembled context prior to model invocation—guaranteeing that forbidden facts are entirely absent.
- Empirical Validation: On a synthetic Contextual-Integrity suite, zero forbidden facts entered the assembled context (whereas unscoped baselines included them by construction), and security audits confirmed that all read paths fail closed. (Note: Evidence remains preliminary and synthetic).