Agents
Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems
arXiv:2608.17148v1 Announce Type: cross Abstract: A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step i
arXiv:2608.17148v1 Announce Type: cross Abstract: A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context containing a fact relevant to the query yet unauthorized for the current viewers. We introduce authorization before context: a single, anti-monotone audience-membership rule applied at the memory-to-context transition. Each item carries the audience present when it was recorded; the current viewer set is read from channel metadata and falls back to public when ambiguous; and the item is admitted only when every current viewer already belonged to its audience. We prove that this rule gives every participant cross-channel recall while ensuring, by exclusion rather than by model behavior, that nothing recorded for a narrower audience reaches a broader one and that poisoned memory cannot widen its own audience. The boundary is a model-neutral invariant on the exact assembled context: a forbidden fact must be absent before the model is called. On a synthetic Contextual-Integrity suite, no forbidden fact entered the context our boundary assembled, whereas unscoped baselines included such facts by construction; we further audit that every read path fails closed. The evidence is preliminary and synthetic.
Related
- Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS
- Capability Advertisement as a Market for Lemons: A Trust Layer for Heterogeneous Agent Networks
- Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents
- MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG
- Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
Source: arXiv cs.AI | 2026-08-19