🤖 AI

Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems

This paper proposes "authorization before context," a model-neutral security invariant that prevents cross-audience memory leakage in agentic systems by enforcing a strict audience-membership rule at the memory-to-context transition, ensuring that facts recorded for narrower audiences are never exposed to broader ones regardless of model behavior or poisoned inputs.

Original authors: Sibo Liu

Published 2026-08-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sibo Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a personal assistant who never forgets a thing. This digital helper listens to your private conversations, remembers your group chats with friends, and stores the details of your work meetings. It is designed to be useful, pulling up the right information at the right time to help you draft a message or answer a question. But this very strength creates a dangerous weakness. If the assistant learns a secret while you are alone with a friend, it must not accidentally whisper that same secret to your boss later, even if the boss asks a question that seems to require that information. The danger lies in how the assistant builds its thoughts. Before it speaks, it gathers a collection of notes and memories to feed into its brain. If it grabs a private note meant only for you and your friend and slips it into a message for your boss, the secret is out. The damage happens the moment the note is included, long before the assistant even forms a sentence.

This is the specific problem a new study addresses: how to stop a smart assistant from accidentally sharing private memories with the wrong people. The researchers focus on the exact moment the assistant gathers its notes. They propose a simple, strict rule that acts as a gatekeeper before any information is allowed to enter the assistant's working memory. Instead of asking "Is this note helpful?" or "Does this match the question?", the system asks a single, unyielding question: "Was everyone listening to this message already present when this note was first written?" If the answer is yes, the note is allowed in. If even one person in the current conversation was not there when the note was created, the note is blocked immediately. This rule works like a bouncer checking a guest list, but it does so before the party even starts, ensuring that no private information ever crosses the line into a room where it does not belong.

The researchers tested this idea using a computer simulation designed to mimic real-world confusion and trickery. They created a scenario with seventy-nine different situations, ranging from simple one-on-one chats to complex group conversations where the list of participants was unclear or changing. In every single case, they tried to trick the system into leaking a secret. They simulated a situation where a note was written in a private chat between two people, and then the assistant tried to use that note in a group chat with three people. They also simulated a scenario where a malicious actor planted a fake note in a private conversation, hoping it would later appear in a public setting. In all seventy-nine attempts, the strict rule held firm. Not a single forbidden fact made it into the assistant's working notes. The system successfully blocked every unauthorized piece of information, proving that the rule works by design, not by luck.

What makes this approach different is that it does not rely on the artificial intelligence to be careful. Many current systems try to fix the problem after the fact, hoping the AI will notice a mistake and refuse to say something private, or trying to edit the final answer to remove sensitive words. The researchers argue that this is too late; the private information has already been seen by the AI's brain. Their method stops the leak before the AI ever sees the forbidden note. It treats the assistant's memory like a set of locked boxes, where each box is labeled with the specific group of people who were present when the contents were put inside. The system only opens a box if the current group of people matches the label exactly. If the group is larger or different, the box stays shut. This ensures that a secret shared in a small circle never accidentally spills out to a larger crowd, and that a fake note planted in a private chat cannot spread to a public one.

The study also looked at what happens when the system is unsure who is listening. In real life, technology sometimes fails to identify exactly who is in a conversation. The researchers programmed their rule to be extremely cautious in these moments. If the system cannot clearly identify the current listeners, it assumes the worst-case scenario: that the audience is everyone. This means it will only show information that was originally shared with the whole world, effectively hiding all private notes. This "fail-safe" behavior ensures that uncertainty never leads to a leak. The researchers confirmed that their system works across different types of memory storage, whether the notes are stored as a simple list, a summary, or a complex web of connections. In every instance, the rule acted as a consistent barrier, preventing unauthorized information from entering the assistant's view.

While the results are promising, the researchers are careful to note that their findings come from a controlled, synthetic environment. They did not test this on a real-world assistant with actual human users or live conversations. The tests were a rigorous simulation, a digital proving ground where the rules were followed perfectly. They have not yet proven that this system works perfectly in the messy, unpredictable real world, nor have they shown that it can handle every possible way a system might be tricked. However, the core idea—that a simple, pre-check rule can stop memory leaks by design—has been demonstrated to work in every scenario they tried. The work suggests that by changing how we check permissions before we gather information, rather than trying to fix mistakes after they happen, we can build assistants that respect privacy by default, keeping private memories exactly where they belong.

Technical Summary: Authorization Before Context

Problem Statement

Personal language agents, acting as delegated proxies for owners, increasingly rely on persistent memory to maintain context across private and shared conversations. This architecture introduces a critical security vulnerability at the memory-to-context transition: the point where stored facts are retrieved and assembled into a prompt for a specific turn.

Current designs suffer from three primary gaps:

Relevance-only retrieval: Systems rank memory by query match but ignore the current audience, allowing facts learned in a private conversation to be surfaced in a group chat.
Post-hoc filtering: Output filtering occurs after the model has already read the prompt. If an unauthorized fact is included in the context, the model may process it, and redacting the final response cannot undo the exposure.
Insufficient isolation: Existing siloing strategies (by user, session, or namespace) fail to distinguish between facts involving a specific user in a one-to-one context versus a group context. They do not treat the audience (the set of participants present at the time of recording) as the fundamental unit of access control.

The core threat is cross-audience memory leakage, where a fact relevant to a query but unauthorized for the current viewers is included in the prompt. This includes risks from cross-audience prying, channel ambiguity (inconsistent participant sets), and poisoned memory (malicious content planted in one scope reaching another).

Methodology: Authorization Before Context

The paper proposes a model-neutral boundary check applied strictly at the memory-to-context transition, prior to model invocation. The core mechanism is an audience-membership rule based on the principle of Contextual Integrity.

The Admission Rule

Every memory item $m$ carries a fixed audience tag, $Aud(m)$, representing the set of authenticated participants present when the fact was recorded. When assembling a prompt for a conversation turn $C$ , the system determines the current viewer set $V(C)$ from channel metadata.

Admission Condition: An item is admitted to the context if and only if every current viewer was already a member of the item's recorded audience:
$V(C) \subseteq Aud(m)$
Fail-Closed Mechanism: If $V(C)$ cannot be determined (ambiguous or inconsistent metadata), the system defaults to a "public-only" view ( $V(C) = U$ , where $U$ is the set of all participants), admitting only public items.
Poisoning Containment: If an item is injected (poisoned), its audience is bound to the authenticated membership of the origin container at write-time. It cannot expand its audience later; it can only reach viewers who were already present in the origin scope.

System Architecture

Single Shared Store: Unlike siloed systems, the design uses a shared store for all memory. Access is controlled dynamically by the admission rule rather than static partitioning.
Model-Neutral Invariant: The check is performed on the exact assembled context. If a forbidden fact is present, the invariant is violated before the model is called.
Provenance Tracking: The system maintains distinct layers for raw records, derived memory, and exact prompts, linked by provenance to ensure every admission is auditable.

Key Contributions

Audience-Membership Boundary: A formal admission rule that guarantees one-way confinement (facts from narrow audiences never reach broader ones) while preserving cross-channel recall (a user sees all facts they were part of, regardless of the channel).
Model-Neutral Invariant: A security guarantee enforced by exclusion (preventing unauthorized facts from entering the context) rather than by content redaction or output scoring.
Implementation-Grounded Traces: A synthetic evaluation suite ("Contextual-Integrity") demonstrating that a single audience decision governs structurally different memory stores (recency buffer, long-term summary, and knowledge graph).
Fail-Closed Auditing: Verification that every read path resolves authorization before assembly, ensuring that ambiguous viewer sets result in zero leakage of non-public data.

Results

The author evaluated the system using a fixed-seed synthetic generator across 79 scenarios spanning 13 families, including adversarial settings, poisoned memory, and ambiguous viewer detection.

Zero Leakage: In all 79 scenarios, 0 forbidden facts entered the unauthorized context.
Fail-Closed Coverage: The system correctly failed closed (admitting only public data) in all 16 scenarios involving ambiguous or unknown viewer sets.
Policy Agreement: The observed authorization decisions matched the expected audience policy in 100% of cases.
Read Path Verification: A hermetic run (without a model) confirmed that the boundary metric is observed on the assembly path itself. The system successfully prevented planted content from surfacing in contexts containing viewers outside the origin audience.

The evaluation confirms that the rule successfully prevents cross-audience exposure while maintaining recall for authorized participants.

Significance and Claims

The paper positions this work as a foundational shift in agent memory security, moving from content-based filtering to audience-based exclusion.

Scope of Claim: The author explicitly states they claim only that, in the evaluated configuration, no known forbidden fact entered unauthorized context and every audited read path failed closed. They do not claim superiority in recall quality, action safety, or production reliability.
Limitations: The data is synthetic; the results hold by construction due to the deterministic nature of the membership test rather than measured attack success against a live model. The paper acknowledges that "audience widening" (promoting facts known by multiple contacts to a shared audience) is out of scope, as inferring such unions would reintroduce content inference risks.
Contribution to Field: The work addresses the underexplored gap of confidentiality in agent-memory security, offering a "model-neutral" invariant that prevents leaks by construction rather than relying on the model's ability to refuse harmful inputs.

The paper concludes that while the current implementation is preliminary and synthetic, it establishes a provable invariant for preventing memory leakage in agentic systems, distinct from prior work that relies on post-hoc scoring or rigid siloing.