Don't Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication

Don’t Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication Daksh Pandey† , Sayon Duttagupta‡ , Xinhai Zou‡ , Amit Singh Bhati‡§ † IIT Roorkee ‡ COSIC, KU Leuven

arXiv:2610.25032v1 [cs.CR] 18 Oct 2026

§ 3MI Labs

daksh p@ph.iitr.ac.in, {sayon.duttagupta, xinhai.zou}@esat.kuleuven.be amitsingh.bhati@3milabs.tech Abstract—An AI agent can reproduce the distribution of its messages and of the receiver’s task outcomes while disclosing private information that the task never required. We ask what a passive audit can certify when the auditor knows the authorised sender and the exact observable law but has no trusted pairing of messages with the private states behind them. For a single round, compatible mutual-information leakage forms a sharp interval, and fixing the entire task-relevant message law, with every declared task utility, can still leave a full private bit undetermined; total leakage is determined if and only if, in every task state, the remaining private state or the authorised message is a deterministic function of that state. For a sender, such as an LLM, that selects among its own responses, we prove that in a balanced case its change to the message law within each task state equals (1 − 2−𝑘 ) times the honest messages’ dependence on the attribute, which also sets, up to a constant, how many messages a monitor needs. With Qwen2.51.5B-Instruct on a synthetic routing task, selection among 16 responses lets a public decoder recover a private bit in all 8,192 held-out rounds at 98.60% routing accuracy (honest sender 98.90%). A monitor that knows the selection rule reaches AUC 0.645 on single messages, close to the ceiling of 0.671 that honest messages predict, and 0.972 over 16, while generic monitors stay near chance. A law-preserving sender built from the same samples recovers the bit in 97.7% of rounds, and every monitor without the true bit stays near chance against it. A canonical task interface preserves every receiver decision and bounds the remaining information about a balanced attribute by twice the routing-error rate, even for a receiver that shares a key with the sender. These results distinguish what passive auditing can certify from what restricting communication can enforce.

1. Introduction An inter-agent channel can reproduce its authorised message distribution exactly while carrying more information about the sender’s private state. Consider a personal AI assistant running on a user’s device. The assistant can access private emails, documents or health records, but may delegate a routine task to a cloud-based agent that has no legiti-

mate need for unrelated information in the local files. A local agent that is compromised, for example through a tampered runtime or indirect prompt injection [1], or that colludes with the cloud agent, could condition its messages on that information and convey a sensitive fact, such as whether a private record contains a particular diagnosis, without stating it explicitly. The cloud agent would still complete its task, and the messages could keep the distribution expected at the communication boundary. This local-to-cloud trust boundary makes unwanted information flow and secret collusion a concrete concern for multi-agent systems [2], [3]. In the terms of the confinement problem [4], the private fact leaves its compartment through a covert channel. Monitoring is a natural response, but what can it establish? A passive auditor at the device’s communication boundary can inspect every outgoing message, compare the distribution of these messages with that of an authorised sender, and observe the cloud agent’s actions. It may even know how private records and task inputs are distributed. It is not told which record lies behind a given response, which would disclose that record, and network-level logs carry no trusted provenance linking a response to the private context used to generate it. This raises the question we study. What does agreement of the observed communication law certify about leakage of private state? We grant the monitor deliberately favourable knowledge (the state distribution, the reference sender, the fixed receiver, the suspected attacks, and the exact observable law) but not the deployed stateconditioned sender or a trusted pairing of private state with message. Any ambiguity that remains is therefore structural, not a finite-sample limitation. We make this concrete with the incident-routing task that we also use in our experiment. A sender reads an incident record, whose task-relevant part 𝑅 is one of 16 routes, and writes a short message 𝑍, from which a fixed receiver parses an action 𝐴. The record also contains administrative fields 𝑁 that routing does not need, one bit of which we call 𝐵. Sect. 4.5 gives an exact pair of senders that produce the same joint distribution of route, message and receiver action and route every incident correctly, yet under one of them a public decoder recovers 𝐵 with certainty. Even a monitor that is told the true route of each incident cannot tell them

(a) Communication and observation Private state 𝑆 = (𝑅, 𝑁 )

Sender 𝑄

𝑍

No trusted 𝑆–𝑍 pairing

Receiver 𝜌

Action 𝐴

Passive monitor: 𝑍 (and possibly 𝐴)

(b) Same message law, different hidden pairings Reference sender 𝑃0

Alternative sender 𝑄

Private 𝐵

Message bit 𝐽

Private 𝐵

Message bit 𝐽

0

0

0

0

1

1

1 𝐵⊥𝐽 | 𝑅

1 𝐽=𝐵

Same audited (𝑅, 𝑍 , 𝐴) law; different 𝐵–𝑍 dependence

Figure 1. The missing private-state–message pairing. (a) A passive monitor observes messages and optionally receiver actions, but has no trusted pairing with the sender’s private state. (b) In the exact witness of Sect. 4.5, b 𝐽 ): the both senders have the same task-conditioned message law 𝑍 = ( 𝑅, reference draws 𝐽 independently of private bit 𝐵, whereas the alternative sets 𝐽 = 𝐵. Edges indicate possible pairings, not their probabilities. The observable task law is unchanged despite different private-state leakage.

apart. For a single round and an unrestricted sender, we characterise this ambiguity by treating the audit as a partialidentification problem. When only the overall message law 𝛽 is fixed, every coupling of the private-state distribution 𝜇 and 𝛽 is compatible with the audit, observing the actions of a fixed receiver adds nothing (Proposition 3.1), and the compatible leakage values form the sharp interval [0, 𝐺 (𝜇, 𝛽)], where 𝐺 is the largest mutual information attained by such a coupling (Proposition 3.2). The ambiguity survives a much stronger audit, in which the entire taskrelevant communication law of (𝑅, 𝑍) is fixed rather than an expected utility score. This preserves the full distribution of (𝑅, 𝑍, 𝐴) and hence every declared utility based on (𝑅, 𝐴) (Proposition 4.1), yet every task-conditioned coupling of a private attribute with the message remains realisable (Theorem 4.2). We derive the sharp leakage intervals and show that total leakage is determined if and only if, in every task state, the remaining private state or the authorised message is determined by that state (Corollary 4.3). We also give the best recovery of a private attribute by a public decoder, an exact condition for perfect recovery, and the best recovery when the message law may change by a bounded amount (Corollaries 4.4 to 4.6). Fig. 1 illustrates the audit boundary and two such senders. The coupling viewpoint connects our analysis to information-theoretic steganography, where perfectly secure encodings correspond to couplings and efficient ones to minimum-entropy couplings [5]. We use the same tools from the auditor’s side. The hidden content is then the sender’s own private state, on which honest messages may already depend, and the question is which dependencies on it an audit can exclude, including under task preservation, and

when it excludes them all. That an output law alone does not bound dependence on secrets is the probabilistic form of the refinement paradox of information flow [6], [7]; our results quantify it for passive audits. The formal sender model permits arbitrary stateconditioned message kernels. To show one realisable mechanism, we analyse an LLM sender that draws 𝑘 ordinary reference responses and emits the first whose public decoding agrees with a private bit, a bounded, keyless variant of the rejection-sampling encoder of provably secure steganography [8]. Its recovery law is exact, and in a balanced case its detectability is proportional to the honest sender’s own dependence on the attribute (Theorem 5.1), so a more discreet honest sender makes selection harder to detect. With Qwen2.5-1.5B-Instruct [9] on a synthetic incident-routing task, selection among 𝑘 = 16 candidates recovers the private bit in all 8,192 held-out rounds, at 98.60% routing accuracy against 98.90% for the honest sender (paired 95% interval [−0.65, 0.04] points). Monitors based on message structure, character features and surprisal stay near chance (AUC 0.49 to 0.50), while a monitor that knows the selection rule reaches AUC 0.645 on single messages, close to the ceiling of 0.671 that Theorem 5.1 predicts from honest messages alone, and 0.972 over 16. The law-preserving sender of Proposition 5.2, run on the same samples, recovers the bit in 97.72% of rounds (predicted 98.00%), and that monitor gives only AUC 0.540 against it. Mapping messages to a canonical form of the parsed route leaves every receiver decision unchanged and bounds what any decoder can learn about the bit in terms of the routingerror rate, also for a receiver that shares a key with the sender. The law-preservation results are proved and realised by the construction of Sect. 4.5, and the experiment shows their practical consequence. Contributions. • Sharp limits of passive auditing (Sects. 3 and 4). For a single round and an unrestricted sender, the leakage values compatible with an audit form sharp intervals, both for a fixed message law (Proposition 3.2, Corollary 3.4) and for a fixed task-relevant law that preserves every declared utility (Theorem 4.2, Corollary 4.3). Matching the task-relevant law determines total leakage if and only if, in every task state, the remaining private state or the authorised message is determined by that state. An exact witness preserves the full task-relevant observable law while leaking one more private bit (Table 1). • Optimal recovery (Sects. 4.4 and 5.2). We give the best recovery of a private attribute by a public decoder and an exact condition for perfect recovery (Corollaries 4.4 and 4.5), an idealised law-preserving sender that attains the optimum with two reference draws per message on average (Proposition 5.2), and the best recovery when each task-conditioned message law may change by a bounded amount (Corollary 4.6). • Detectability of selection (Sect. 5). For a sender, such as an LLM, that selects among its own responses, we give the exact kernel and recovery law and prove that,

in a balanced case, its change to each task-conditioned message law is (1 − 2−𝑘 ) times the honest attribute– message dependence in total variation, and (1 − 2−𝑘 ) 2 times it in 𝜒2 divergence, which determines, up to a constant factor, how many messages a monitor needs (Theorem 5.1). A more discreet honest sender thus makes selection harder to detect, while a sender that shares fresh key bits with the receiver can leave even the state–message law unchanged. • Measurements with an open-weight LLM (Sect. 6). Selection makes a private bit recoverable in all 8,192 test rounds at 98.60% routing accuracy against 98.90% for the honest sender, and recovery matches the exact selection law within 0.55 points at every budget. Generic monitors stay near chance, and a selectionaware monitor reaches AUC 0.645 on single messages, close to the ceiling of 0.671 that Theorem 5.1 predicts from honest messages, and 0.972 over 16. A lawpreserving sender built from the same samples attains the predicted recovery while that monitor stays near chance. • Interface enforcement (Sects. 5.3 and 6.4). A canonical task interface preserves every receiver decision by construction and, for an attribute balanced within each task state, keeps residual information at most twice the routing-error rate for every sender, including keyed ones (Proposition 5.3); on our test distribution this is 0.028 bits. Full proofs are in Appendix A, and experimental details and reproducibility information are in Appendix B. Artefacts. An artefact bundle is provided at https://anonym ous.4open.science/r/passive-monitoring-EC82/. It includes the code that reproduces the experiment in Sect. 6, with the pinned model, seeds and sample sizes.

2. Model We model one round of communication between a sender that observes a private state and a fixed receiver. The central distinction is between the sender’s dependence on that private state and the distribution of messages that is visible to a passive monitor.

2.1. Agents, Private State, and the Reference Sender Let S, Z, and A be finite sets of private states, messages, and receiver actions. We condition throughout on a fixed public context and suppress it from the notation. The environment draws 𝑆 ∼ 𝜇, where zero-probability states are omitted from S. The sender observes the realised state 𝑆 = 𝑠 and emits a message 𝑍 according to a stochastic kernel 𝑄(𝑧 | 𝑠), and a fixed receiver then produces an action according to 𝜌(𝑎 | 𝑧). The resulting joint distribution is 𝑝 𝑄 (𝑠, 𝑧, 𝑎) = 𝜇(𝑠)𝑄(𝑧 | 𝑠) 𝜌(𝑎 | 𝑧).

(1)

For an LLM-based sender, the kernel 𝑄 includes any prompting, sampling, decoding, or output-selection procedure that affects the message sent; our analysis concerns this emitted law, not a particular implementation. We compare the deployed sender with a fixed reference sender 𝑃0 (𝑧 | 𝑠), whose induced message distribution is ∑︁ 𝛽(𝑧) := 𝜇(𝑠)𝑃0 (𝑧 | 𝑠). (2) 𝑠∈ S

We often refer to 𝑃0 as the “honest” sender, but only in the sense of a prescribed baseline. The term does not imply that the reference communication is private or harmless: ordinary task-directed messages may already reveal information about the private state. Unless stated otherwise, 𝑄 ranges over all stochastic kernels from S to Z. Particular model architectures or trusted output mechanisms may permit a smaller class; our theoretical results first ask what follows from the observation boundary alone.

2.2. What the Monitor Sees and Knows For a deployed sender 𝑄, write ∑︁ ¯ 𝑄(𝑧) := 𝜇(𝑠)𝑄(𝑧 | 𝑠)

(3)

𝑠∈ S

for the distribution of emitted messages. The baseline monitor observes 𝑍 and may also observe the receiver action 𝐴. Since the receiver is fixed, their observable joint law is ¯ 𝜌(𝑎 | 𝑧). 𝑝 𝑄 (𝑧, 𝑎) = 𝑄(𝑧)

(4)

Thus, once the message law 𝑄¯ is fixed, observing the receiver action does not reveal anything further about which sender kernel produced it. The monitor is passive, in the sense of the warden in Simmons’s prisoners’ problem [10]: it observes communication crossing the channel without altering it. We otherwise give it substantial knowledge. It knows the state distribution 𝜇, the reference sender 𝑃0 , and the receiver 𝜌; it may also know which attacks are suspected, though not which sender is deployed. For the negative results we also give it the exact distribution at its observation boundary, so that none of them can be attributed to sampling error. What it does not receive is the realised private state associated with each deployed message. In particular, it has no trusted record pairing 𝑆 with 𝑍, and no trusted interface through which it can query the deployed state-conditioned kernel 𝑄(· | 𝑠). This distinction is the source of the problem studied below. Knowing how the reference sender would behave on a hypothetical state does not reveal which state produced an observed deployed message. A monitor with trusted access to the realised private state has a strictly stronger observation boundary (Sect. 4.6). Our question is what a passive communication monitor of the kind described above can certify. Because it knows the exact laws and the suspected attacks, whatever it cannot certify is due to the missing state–message pairing.

2.3. Leakage and the Compatible Set

3.1. Observational Equivalence

We measure private-state information in the emitted message by the mutual information 𝐼𝑄 (𝑆; 𝑍) [11], where the subscript records that the joint law of (𝑆, 𝑍) depends on the deployed sender 𝑄, and compare the deployed sender with the reference through the leakage increment Δ(𝑄) := 𝐼𝑄 (𝑆; 𝑍) − 𝐼0 (𝑆; 𝑍), where the subscript 0 denotes quantities computed under 𝑃0 . The difficulty is that 𝐼𝑄 (𝑆; 𝑍) depends on the joint state– message law, whereas the baseline monitor observes only its message marginal. To make this precise, write P (S × Z) for the set of probability distributions on S × Z, and let

Equal message laws already imply equal distributions over everything observed by the baseline monitor.

Γ(𝜇, 𝛽) := {𝛾 ∈ P (S × Z) : 𝛾𝑆 = 𝜇, 𝛾 𝑍 = 𝛽}

(5)

be the set of couplings of the state distribution 𝜇 and the reference message distribution 𝛽. Define 𝐺 (𝜇, 𝛽) :=

max 𝐼 𝛾 (𝑆; 𝑍).

Equivalently, min

𝐻 (𝛾),

𝛾 ∈Γ( 𝜇,𝛽)

(7)

so 𝐺 is attained by a minimum-entropy coupling of the two marginals, which is NP-hard to compute in general [12] but approximable to within one bit in polynomial time [13]. Finally, we call  I (𝛽) := 𝐼𝑄 (𝑆; 𝑍) : 𝑄¯ = 𝛽 (8) the compatible leakage set: the set of private-state leakage values that remain possible after fixing the communication law observed by the monitor. Sect. 3 characterises this set. We then strengthen the observation boundary by fixing how messages are distributed for the task-relevant part of the private state.

3. Leakage Under a Fixed Message Law We first consider the baseline monitor of Sect. 2. Suppose the deployed sender produces exactly the same message distribution as the reference sender, 𝑄¯ = 𝛽.

¯ 𝜌(𝑎 | 𝑧), which equals Proof. By Eq. (4), 𝑝 𝑄 (𝑧, 𝑎) = 𝑄(𝑧) ¯ 𝛽(𝑧) 𝜌(𝑎 | 𝑧) = 𝑝 0 (𝑧, 𝑎) if 𝑄 = 𝛽. □ Thus no test on the monitored variables distinguishes the two senders better than chance, and the law of any public decoder 𝑑 (𝑍) is fixed too, but not how the decoded value relates to the private state.

3.2. Compatible Leakage Range

(6)

𝛾 ∈Γ( 𝜇,𝛽)

𝐺 (𝜇, 𝛽) = 𝐻 (𝜇) + 𝐻 (𝛽) −

Proposition 3.1 (Equal message laws give the same audit distribution). Let 𝑄 satisfy 𝑄¯ = 𝛽. Then 𝑄 and the reference sender 𝑃0 induce the same distribution over (𝑍, 𝐴). Consequently, every randomised test or public post-processing of (𝑍, 𝐴) has the same distribution under the two senders.

(9)

This is much weaker than requiring 𝑄(· | 𝑠) = 𝑃0 (· | 𝑠) for every private state. Different state-conditioned sender kernels may have the same message marginal because marginalising over 𝑆 removes the information about which states produced which messages. We now ask two questions. First, can the monitor distinguish such senders from the reference using the variables available at its audit boundary? Second, how much can their private-state leakage still differ?

The preceding proposition concerns what the monitor can observe. It does not imply that the hidden state–message dependence is the same. Recall from Sect. 2 that fixing 𝜇 and 𝛽 leaves the joint law of (𝑆, 𝑍) free to range over the coupling set Γ(𝜇, 𝛽). This gives the complete compatible leakage range. Proposition 3.2 (Leakage range under a fixed message law). Over the full sender class, I (𝛽) = [0, 𝐺 (𝜇, 𝛽)].

(10)

In particular, the message law determines the leakage if and only if 𝜇 or 𝛽 is a point mass. Every sender with 𝑄¯ = 𝛽 induces the coupling 𝛾𝑄 (𝑠, 𝑧) = 𝜇(𝑠)𝑄(𝑧 | 𝑠) in Γ(𝜇, 𝛽), and, since 𝜇(𝑠) > 0, every coupling 𝛾 defines such a sender 𝑄 𝛾 (𝑧 | 𝑠) = 𝛾(𝑠, 𝑧)/𝜇(𝑠). The independent coupling gives zero mutual information, a minimum-entropy coupling attains 𝐺 (𝜇, 𝛽), and interpolating between them attains every value in between (Appendix A.1). Because the reference sender itself has message law 𝛽, the corresponding range of changes relative to the reference is Corollary 3.3 (Leakage change relative to the reference sender).  Δ(𝑄) : 𝑄¯ = 𝛽 = [−𝐼0 (𝑆; 𝑍), 𝐺 (𝜇, 𝛽) − 𝐼0 (𝑆; 𝑍)] . (11) The same holds for the vulnerability-based measures of quantitative information flow [14]. Corollary 3.4 (Other leakage measures). For every gain function 𝑔 with positive prior vulnerability, the compatible multiplicative 𝑔-leakage values over senders with 𝑄¯ = 𝛽 form an interval from 0 to a maximum attained at a vertex of Γ(𝜇, 𝛽). For Bayes vulnerability this maximum is
log2 max𝑑 [1−TV(𝜇, 𝑞 𝑑 )]/max𝑠 𝜇(𝑠) , where 𝑑 ranges over maps Z → S and 𝑞 𝑑 is the law of 𝑑 (𝑍) under 𝛽.

Evaluating this maximum is NP-hard in general, since for 𝜇 uniform on two states it equals 1 if and only if 𝛽 gives some set of messages mass 1/2, which is the partition problem. The important distinction is therefore between fixing what the monitor sees and fixing how those observations depend on private state. Equal message laws fix the former exactly and leave the latter undetermined unless 𝜇 or 𝛽 is a point mass.

3.3. Composition Over Rounds

Sect. 3 fixed the overall message law, but some sender kernels satisfying that condition may no longer communicate what the receiver needs for its task. We now impose a stronger requirement: preserve how messages are distributed for each task-relevant state. We show that this preserves the declared task behaviour while still allowing the message to carry different information about the remaining private state.

4.1. Task-Relevant State and Utility

The same reasoning applies to repeated communication, but the object that must be preserved is the distribution of the entire transcript, not merely the message distribution in each round separately. For 𝑇 rounds, write 𝑆𝑇 = (𝑆1 , . . . , 𝑆𝑇 ) and 𝑍 𝑇 = (𝑍1 , . . . , 𝑍𝑇 ), let 𝜇 (𝑇 ) be the law of 𝑆𝑇 , and let 𝛽 (𝑇 ) (𝑧𝑇 ) := Pr0 [𝑍 𝑇 = 𝑧𝑇 ] be the reference law of the transcript. Treating 𝑆𝑇 and 𝑍 𝑇 as single variables, Propositions 3.1 and 3.2 apply to the unrestricted block-sender class, in which the sender may observe the entire sequence 𝑆𝑇 before generating 𝑍 𝑇 . In particular, if a deployed system satisfies Pr [𝑍 𝑇 = 𝑧𝑇 ] = 𝛽 (𝑇 ) (𝑧𝑇 )

4. Leakage Under a Fixed Task-Relevant Law

∀𝑧𝑇 ,

(12)

Let the private state be 𝑆 = (𝑅, 𝑁), where 𝑅 contains the information relevant to the declared task and 𝑁 is the remaining private state. We do not assume that they are independent. Write 𝜋(𝑟) = Pr[𝑅 = 𝑟] and 𝛼𝑟 (𝑛) = Pr[𝑁 = 𝑛 | 𝑅 = 𝑟] for 𝜋(𝑟) > 0. We consider a bounded task utility 𝑢(𝑅, 𝐴), with 𝑈 (𝑄) := E𝑄 [𝑢(𝑅, 𝐴)].

(14)

Thus, the declared task objective depends on the private state through 𝑅 and on the receiver’s action 𝐴. Under the reference sender, define

𝑄

then its monitored message transcript has the same distribution as under the reference sender. Over the unrestricted block-sender class, the compatible leakage values are exactly h  i 𝐼𝑄 (𝑆𝑇 ; 𝑍 𝑇 ) ∈ 0, 𝐺 𝜇 (𝑇 ) , 𝛽 (𝑇 ) . (13)

𝛽𝑟 (𝑧) := Pr [𝑍 = 𝑧 | 𝑅 = 𝑟],

𝜆0 (𝑟, 𝑧) := 𝜋(𝑟) 𝛽𝑟 (𝑧). (15) Here 𝜆 0 is the reference joint law of (𝑅, 𝑍). Unlike the overall message law 𝛽, it records how communication varies with the task-relevant part of the private state.

For a causal sender, whose message 𝑍𝑡 may depend only on 𝑆 𝑡 and 𝑍 𝑡 −1 , Eq. (13) remains an outer bound, but not necessarily an attainable range: not every coupling of 𝑆𝑇 and 𝑍 𝑇 can be implemented without access to future states. 𝐺 is also superadditive over rounds. For a fair bit and 𝛽 = (2/3, 1/3), one round admits 0.459 bits, but two independent rounds admit 1.394 bits for a block sender and 1.099 for a causal one. Causal senders correspond to the couplings in which each 𝑍 𝑡 is independent of (𝑆𝑡+1 , . . . , 𝑆𝑇 ) given 𝑆 𝑡 ; with 𝜇 (𝑇 ) fixed these constraints are linear, so their compatible leakage values also form an interval, with the maximum at a vertex. Matching each round’s marginal is not sufficient either. Two fair message bits that are independent under the reference but equal under an alternative sender have the same round marginals, yet a monitor that sees both rounds tells them apart, since 𝑍1 = 𝑍2 with probability 1/2 under one and 1 under the other. If rounds are genuinely independent under both systems, then equality of the single-round law does compose by factorisation. In a stateful or adaptive system, or for a private attribute that persists across rounds, such independence cannot be assumed, and the relevant audit object is the full transcript law.

4.2. Task-Preserving Class

0

We restrict attention to senders that reproduce this joint law: o n (𝑅,𝑍 ) F𝑅 := 𝑄 : 𝑃𝑄 = 𝜆0 . (16) Equivalently, Pr𝑄 [𝑍 = 𝑧 | 𝑅 = 𝑟] = 𝛽𝑟 (𝑧) for every 𝑟 of positive probability. This is stronger than matching the overall message distribution. Proposition 4.1 (Preservation of task-relevant behaviour). Every 𝑄 ∈ F𝑅 preserves the reference joint distribution of (𝑅, 𝑍, 𝐴). In particular, 𝑄¯ = 𝛽 and 𝑈 (𝑄) = 𝑈 (𝑃0 ). Indeed, for every 𝑄 ∈ F𝑅 , Pr [𝑅 = 𝑟, 𝑍 = 𝑧, 𝐴 = 𝑎] = 𝜆 0 (𝑟, 𝑧) 𝜌(𝑎 | 𝑧),

(17)

𝑄

which is also the reference law. The declared utility depends only on (𝑅, 𝐴), so it is unchanged. This condition is sufficient, but not necessary, to preserve expected utility: different communication laws can give the same value of the scalar objective 𝑈 (𝑄).

4.3. Attribute–Message Couplings Under a Fixed Task Law Fix any finite-valued private attribute 𝐵 = 𝑔(𝑅, 𝑁) and let 𝑝 𝑟 (𝑏) = Pr[𝐵 = 𝑏 | 𝑅 = 𝑟]. Within each taskrelevant state 𝑟, the attribute distribution 𝑝 𝑟 and the message distribution 𝛽𝑟 are fixed. The following result shows that these are the only restrictions on their joint dependence. Theorem 4.2 (Attribute–message couplings under a fixed task law). For every 𝑟 with 𝜋(𝑟) > 0, n o ( 𝐵,𝑍 ) | 𝑅=𝑟 𝑃𝑄 : 𝑄 ∈ F𝑅 = Γ( 𝑝 𝑟 , 𝛽𝑟 ). (18) Any choice of one coupling from Γ( 𝑝 𝑟 , 𝛽𝑟 ) for each 𝑟 can be realised simultaneously by a sender in F𝑅 . To see why, choose couplings 𝜂𝑟 ∈ Γ( 𝑝 𝑟 , 𝛽𝑟 ) and, on the positive state support, define 𝜂𝑟 (𝑔(𝑟, 𝑛), 𝑧) . 𝑄 𝜂 (𝑧 | 𝑟, 𝑛) := 𝑝 𝑟 (𝑔(𝑟, 𝑛))

(19)

This is a valid sender kernel. Í Summing over 𝑁 gives Pr𝑄 𝜂 [𝑍 = 𝑧 | 𝑅 = 𝑟] = 𝑏 𝜂𝑟 (𝑏, 𝑧) = 𝛽𝑟 (𝑧), while its conditional joint law of (𝐵, 𝑍) is exactly 𝜂𝑟 . The full verification is in Appendix A.2. Thus, preserving the task-relevant communication law does not fix how messages depend on a selected private attribute. Taking 𝐵 = 𝑁 gives the same characterisation for the entire remaining private state. If 𝑅 is constant, this reduces to the fixed-message-law setting of Sect. 3.

4.4. Leakage and Recovery The coupling characterisation gives exact leakage ranges. Define ∑︁ 𝐼 𝑅 := 𝐼0 (𝑅; 𝑍), 𝐶𝑅 := 𝜋(𝑟)𝐺 (𝛼𝑟 , 𝛽𝑟 ), (20) 𝑟

and, for the selected attribute, ∑︁ 𝐶 𝐵 := 𝜋(𝑟)𝐺 ( 𝑝 𝑟 , 𝛽𝑟 ).

(21)

𝑟

Corollary 4.3 (Leakage under task-law preservation). Over F𝑅 , the possible total and attribute-specific leakage values are exactly {𝐼𝑄 (𝑆; 𝑍) : 𝑄 ∈ F𝑅 } = [𝐼 𝑅 , 𝐼 𝑅 + 𝐶𝑅 ], {𝐼𝑄 (𝐵; 𝑍 | 𝑅) : 𝑄 ∈ F𝑅 } = [0, 𝐶 𝐵 ].

(22) (23)

every intermediate value in both intervals and the point-mass conditions. The reference may already leak information about 𝑁. Writing 𝐾0 := 𝐼0 (𝑁; 𝑍 | 𝑅), the possible increments are {Δ(𝑄) : 𝑄 ∈ F𝑅 } = [−𝐾0 , 𝐶𝑅 − 𝐾0 ].

(24)

Hence the task-relevant law determines total leakage if and only if, in every route, 𝑁 or the reference message is determined by 𝑅, as for an error-free canonical interface (Sect. 5.3), and a strictly positive increase over the reference is possible when 𝐶𝑅 > 𝐾0 . Leakage is not the same as successful recovery of an individual attribute. Consider a fixed, public decoder 𝑑 : Z → B, and let ∑︁ 𝑞 𝑟𝑑 (𝑏) := 𝛽𝑟 (𝑧). (25) 𝑧:𝑑 (𝑧)=𝑏

For distributions 𝑝, 𝑞, write TV( 𝑝, 𝑞) = 21

Í

𝑏 | 𝑝(𝑏) − 𝑞(𝑏)|.

Corollary 4.4 (Recovery with a public decoder). For any fixed 𝑑, ∑︁   max Pr [𝑑 (𝑍) = 𝐵] = 𝜋(𝑟) 1 − TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) . (26) 𝑄 𝑄∈ F𝑅 𝑟

Within each 𝑟, a maximal coupling of 𝐵 and 𝑑 (𝑍) attains the stated agreement probability [15, Prop. 4.7]; Theorem 4.2 then realises it through a sender with the required message law (Appendix A.4). Corollary 4.5 (Condition for perfect public recovery). There exists a sender 𝑄 ∈ F𝑅 with Pr𝑄 [𝑑 (𝑍) = 𝐵] = 1 if and only if, for every 𝑟 with 𝜋(𝑟) > 0 and every 𝑏, ∑︁ 𝛽𝑟 (𝑧) = 𝑝 𝑟 (𝑏). (27) 𝑧:𝑑 (𝑧)=𝑏

This is a mass-balance condition: within each taskrelevant state, the reference probability assigned to messages decoded as 𝑏 must equal the probability of attribute value 𝑏. Neither a secret decoder nor a change to the receiver is required. Appendix A.5 proves both directions and constructs a witness sender. A sender that may change each task-conditioned message law slightly can do better. Corollary 4.6 (Recovery under bounded distortion). Let 𝑑 𝑍 |𝑟 be onto. Over senders with TV(𝑃𝑄 , 𝛽𝑟 ) ≤ 𝛿𝑟 for every Í 𝑟, the largest value of Pr𝑄 [𝑑 (𝑍) = 𝐵] is 𝑟 𝜋(𝑟) [1 − max{0, TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) − 𝛿𝑟 }].

Moreover, 𝐶𝑅 = 0 if and only if, for every 𝑟 with 𝜋(𝑟) > 0, 𝛼𝑟 or 𝛽𝑟 is a point mass, and 𝐶 𝐵 = 0 if and only if, for every such 𝑟, 𝑝 𝑟 or 𝛽𝑟 is a point mass.

Perfect recovery is thus possible if and only if 𝛿𝑟 ≥ TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) for every 𝑟 (proof in Appendix A.5).

The chain rule gives 𝐼𝑄 (𝑆; 𝑍) = 𝐼 𝑅 + 𝐼𝑄 (𝑁; 𝑍 | 𝑅). Within each 𝑟, independence attains the lower endpoint and a maximum-information coupling attains the upper endpoint. Continuity gives every intermediate value. The same argument applies to 𝐵, and 𝐶 𝐵 ≤ 𝐶𝑅 because 𝐵 is a function of (𝑅, 𝑁). Appendix A.3 proves attainability of

4.5. A Concrete Construction Consider 𝑆 = (𝑅, 𝐵), with 𝑅 uniform on 16 routes and b 𝐽), with 𝑅 b = 𝑅, and 𝐵 an independent fair bit. Let 𝑍 = ( 𝑅, b let the fixed receiver output 𝐴 = ( 𝑅, 𝐴2 ) = 𝑍, so 𝐴2 = 𝐽. b = 𝑅}. The declared utility is 𝑢(𝑅, 𝐴) = 1{ 𝑅

TABLE 1. E XACT WITNESS . T HE REFERENCE AND ALTERNATIVE HAVE THE SAME AUDITED TASK LAW BUT DIFFERENT PRIVATE - STATE DEPENDENCE . Quantity (𝑅, 𝑍 , 𝐴) law 𝐼 (𝑆; 𝑍 ) 𝐼 (𝐵; 𝑍 | 𝑅) 𝑈 Pr[ 𝐴2 = 1] 𝐷𝐵

Reference

Alternative

𝜆0 𝜌 4 bits 0 bits 1 1/2 0

𝜆0 𝜌 5 bits 1 bit 1 1/2 1

The reference sender copies 𝑅 and draws 𝐽 as an independent fair bit. The alternative sender also copies 𝑅, but sets 𝐽 = 𝐵. Both produce Pr[𝑍 = (𝑟, 𝑗) | 𝑅 = 𝑟] = 1/2 for 𝑗 ∈ {0, 1}. Thus, they have exactly the same (𝑅, 𝑍, 𝐴) law and task utility, even though the public decoder 𝑑 (b 𝑟 , 𝑗) = 𝑗 recovers 𝐵 perfectly only under the alternative. The receiver’s second output can also have a different relationship to the private attribute. Define 𝐷 𝐵 := Pr[ 𝐴2 = 1 | 𝐵 = 1] − Pr[ 𝐴2 = 1 | 𝐵 = 0]. This difference is 0 for the reference and 1 for the alternative, although Pr[ 𝐴2 = 1] = 1/2 under both. Table 1 summarises the construction. It realises two couplings from Theorem 4.2: independence between 𝐵 and 𝐽, and perfect alignment 𝐽 = 𝐵.

4.6. What a Stronger Audit Fixes The construction also makes the role of the audit boundary clear. Observing 𝐴 in addition to 𝑍 adds nothing when the receiver is fixed, as Sect. 3 showed. Even if the monitor receives a trusted 𝑅 alongside every message, the two senders above remain indistinguishable: their complete (𝑅, 𝑍, 𝐴) distributions agree. In general, fixing this stronger law leaves the leakage range [𝐼 𝑅 , 𝐼 𝑅 + 𝐶𝑅 ], as established in Corollary 4.3. Trusted information about the remaining state changes the situation. In the construction, an auditor given the true 𝐵 alongside 𝑍 can distinguish the two senders: the totalvariation distance between their (𝐵, 𝑍) laws is 1/2, giving optimal equal-prior discrimination success 3/4 from a single paired observation. If the auditor instead receives a trusted pairing of the full private state 𝑆 and message 𝑍, exact knowledge of their joint law determines 𝐼𝑄 (𝑆; 𝑍) itself, though not what a receiver that shares a key with the sender learns (Sect. 5.2). These statements concern the unrestricted sender class; Sect. 5 analyses a concrete mechanism and a sender that attains the recovery optimum.

5. Selection Channels in a Language-Model Sender We now consider a concrete mechanism available to an LLM sender, which generates several ordinary responses and chooses which one to emit. Such a sender is in general not in F𝑅 , and we characterise how far it departs from the

reference law. By a selection channel we mean the privatestate-dependent choice among complete reference-generated messages, which steganography calls cover selection, not the shared-pad selection of cover positions described by Anderson and Petitcolas [16].

5.1. Selection Among Honest Samples Let 𝐵 = 𝑔(𝑆) be a binary private attribute and let 𝑑 : Z → {0, 1} be a fixed public decoder. Given private state 𝑠, write 𝑏 𝑠 = 𝑔(𝑠) and 𝑎 𝑠 := Pr [𝑑 (𝑍) = 𝑏 𝑠 | 𝑆 = 𝑠]

(28)

0

for the probability that an ordinary reference message already decodes to the intended bit. The selection sender 𝑄 𝑘 draws 𝑘 independent candidates from 𝑃0 (· | 𝑠) and emits the first candidate satisfying 𝑑 (𝑍) = 𝑏 𝑠 . If none matches, it emits one additional, independent reference draw as a fallback. Every emitted message is therefore one of the samples produced by the reference procedure; the choice of which sample to emit is statedependent. This is a bounded form of rejection sampling, closely related to the steganographic encoder of Hopper et al. [8] and to algorithm-substitution attacks that resample coins until a keyed function of the ciphertext reveals a key bit [17], [18]. It requires control of the sender’s sampling loop, as in a compromised agent runtime. Here the decoder is public and unkeyed, and the target bit may already be correlated with honest messages. For any message 𝑧, this rule induces the kernel  𝑄 𝑘 (𝑧 | 𝑠) = 𝑃0 (𝑧 | 𝑠) (1 − 𝑎 𝑠 ) 𝑘 + 1{𝑑 (𝑧) = 𝑏 𝑠 }

𝑘−1 ∑︁

 (29) (1 − 𝑎 𝑠 ) . 𝑖

𝑖=0

The first term accounts for the fallback; the sum accounts for selecting the first matching candidate. In particular, the decoder’s success probability is Pr [𝑑 (𝑍) = 𝐵 | 𝑆 = 𝑠] = 1 − (1 − 𝑎 𝑠 ) 𝑘+1 .

(30)

𝑄𝑘

The extra exponent comes from the fresh fallback. Selection thus makes a private attribute reliably recoverable without changing the reference generator or the public decoder, but because matching candidates are preferred, 𝑄 𝑘 need not preserve 𝛽 or the task-conditioned laws 𝛽𝑟 .

5.2. Detectability The changed selection probabilities give a monitor that knows the mechanism a signal. Let 𝑤 𝑘 (𝑠, 𝑧) denote the bracketed factor in Eq. (29). On the support of the reference message law, the likelihood ratio between selected and reference messages is 𝑄¯ 𝑘 (𝑧) = E0 [𝑤 𝑘 (𝑆, 𝑧) | 𝑍 = 𝑧]. (31) 𝛽(𝑧)

It gives a message-only test without revealing the realised private state. A monitor with trusted 𝑅 can instead use the corresponding ratio conditional on 𝑅 = 𝑟. In a balanced case, detection depends only on information already present in honest messages. Write 𝛿 𝑘 := 1−2−𝑘 . Theorem 5.1 (Detectability of selection, balanced case). Suppose 𝐵 is fair given each 𝑅 = 𝑟 and 𝑎 𝑠 = 1/2 for every state, and for 𝛽𝑟 (𝑧) > 0 put 𝑚 𝑟 (𝑧) := Pr0 [𝐵 = 𝑑 (𝑧) | 𝑍 = 𝑧, 𝑅 = 𝑟]. Within each route, selected and reference messages have likelihood ratio
(32) ℓ𝑘,𝑟 (𝑧) = 1 + 2𝛿 𝑘 𝑚 𝑟 (𝑧) − 21 , and, with 𝐷 𝑟 := 𝑃0(𝐵,𝑍 ) |𝑟 the honest joint law and Π𝑟 := 𝑝 𝑟 ⊗ 𝛽𝑟 , 𝑍 |𝑟 , 𝛽𝑟 ) = 𝛿 𝑘 TV(𝐷 𝑟 , Π𝑟 ), TV(𝑃𝑄 𝑘 𝑍 |𝑟 ∥ 𝛽𝑟 ) = 𝛿2𝑘 𝜒2 (𝐷 𝑟 ∥ Π𝑟 ). 𝜒2 (𝑃𝑄 𝑘

(33)

Over 𝑇 independent rounds with 𝑅 = 𝑟, the largest advantage TPR − FPR of any test lies between 1 − 𝑒 −𝑇 𝑐𝑟 /12 and 𝑍 |𝑟 1 𝑇 𝑐𝑟 ∥ 𝛽𝑟 ). If 𝐵 and 𝑍 are − 1) 1/2 , where 𝑐𝑟 := 𝜒2 (𝑃𝑄 2 (𝑒 𝑘 independent given 𝑅 under the reference, then 𝑄 𝑘 ∈ F𝑅 and the public decoder recovers 𝐵 with probability 1 − 2− (𝑘+1) . The detectable change is thus exactly proportional to how much honest messages already depend on 𝐵, and a monitor needs on the order of 1/𝑐𝑟 messages (proof in Appendix A.6). In the balanced case a more discreet honest sender therefore makes selection harder to detect, and one whose messages are independent of 𝐵 given 𝑅 makes it undetectable by any test of the task-relevant law. For unequal 𝑎 𝑠 , Eq. (31) is the general expression. Keyed senders. If the sender selects on 𝑑 (𝑧) = 𝑏 𝑠 ⊕ 𝜉 for a fresh uniform key bit 𝜉 per message, shared with the receiver and independent of 𝑆, then in the balanced case the emitted law is 𝑃0 (· | 𝑠) for every 𝑠, so no audit of (𝑆, 𝑍, 𝐴) detects it, even with trusted pairings, while the receiver recovers 𝐵 with probability 1 − 2− (𝑘+1) . Leakage to that receiver is 𝐼 (𝑆; 𝑍, 𝜉) rather than the unchanged 𝐼𝑄 (𝑆; 𝑍), and Proposition 5.3 still bounds it at a canonical interface. Law-preserving resampling within a route. The bounded selection sender 𝑄 𝑘 generates candidates for the actual private state and generally changes its emitted message law. By contrast, an idealised resampling sender, with sampling access to the route’s state distribution and to the reference sender, attains the optimal recovery of Corollary 4.4 while preserving the full task-relevant message law. Proposition 5.2 (Law-preserving resampling sender). Fix a public decoder 𝑑 and, for each 𝑟 with 𝜋(𝑟) > 0, a maximal 𝑑 coupling 𝜅★ 𝑟 ∈ Γ( 𝑝 𝑟 , 𝑞 𝑟 ). Assume sampling access to 𝛼𝑟 and to the reference kernel 𝑃0 (· | 𝑟, 𝑛′ ). On input (𝑟, 𝑛) with 𝑏 = 𝑔(𝑟, 𝑛), draw a decoder target 𝑌 = 𝑦 with probability ′ 𝜅★ 𝑟 (𝑏, 𝑦)/𝑝 𝑟 (𝑏). Then independently draw a fresh 𝑛 ∼ 𝛼𝑟 and 𝑍 ′ ∼ 𝑃0 (· | 𝑟, 𝑛′ ) on each trial until 𝑑 (𝑍 ′ ) = 𝑦, and emit the first accepted message. This procedure terminates almost surely, belongs to F𝑅 , and attains the maximum publicdecoder recovery in Corollary 4.4.

Conditional on the selected target 𝑦, the accepted message has law 𝛽𝑟 conditioned on 𝑑 (𝑍) = 𝑦. The resulting (𝐵, 𝑍) law is precisely the lifted maximal coupling from Appendix A.4; the sampling proof is in Appendix A.7. With a binary decoder whose values both have positive probability, the sender needs two reference draws per message on average. Since the induced (𝑅, 𝑍, 𝐴) law equals the reference law, no single-round test confined to those observations can distinguish the senders. Using 𝑞b𝑟𝑑 in place of 𝑞 𝑟𝑑 puts its law in route 𝑟 at total-variation distance exactly TV(b 𝑞 𝑟𝑑 , 𝑞 𝑟𝑑 ) from 𝛽𝑟 ; run this way on our samples, it recovers 𝐵 in 97.72% of rounds while every monitor without the true 𝐵 stays near chance (Sect. 6.3). If the reference never sees 𝑁, the sender’s own draws already have law 𝛽𝑟 , so no samples of other private states are needed. Applied round by round to an attribute that persists, as in our motivating example, both 𝑄 𝑘 and this sender repeat the decoded bit, which a monitor that knows 𝑑 notices within a few rounds; such an attribute can still leak without changing the transcript law (Sect. 3.3) if it is encoded in one round only and the sender is honest otherwise, provided honest messages depend on the private state only through 𝑅 and the attribute is independent of the task states.

5.3. Canonical Interfaces One way to restrict the communication channel is to enforce a canonical task interface. Let 𝐶 = 𝑐(𝑍) be a deterministic transformation with at most 𝐾 possible outputs. Then, 𝐼𝑄 (𝑆; 𝐶) ≤ 𝐻𝑄 (𝐶) ≤ log2 𝐾. (34) The same bound applies to 𝐼𝑄 (𝐵; 𝐶 | 𝑅). It limits the information available after enforcement. Suppose, moreover, that the receiver acts only through 𝑐(𝑍), so that 𝜌(𝑎 | 𝑧) = e 𝜌 (𝑎 | 𝑐(𝑧)), and that canonicalisation is idempotent: 𝑐(𝑐(𝑧)) = 𝑐(𝑧). Thus, the receiver also parses a canonical message to the same result, and replacing 𝑧 with 𝑐(𝑧) preserves the receiver’s action law for every input message. A bounded output alphabet does not by itself prevent leakage about 𝑁. A stronger guarantee is available when the canonical output nearly equals a task-only representation. Let ℎ map each task state to one of the 𝐾 ≥ 2 canonical outputs and suppose Pr𝑄 [𝐶 ≠ ℎ(𝑅)] = 𝜀. Then, for any sender and any private attribute 𝐵 = 𝑔(𝑅, 𝑁), 𝐼𝑄 (𝐵; 𝐶 | 𝑅) ≤ 𝐼𝑄 (𝑁; 𝐶 | 𝑅) ≤ 𝐻𝑄 (𝐶 | 𝑅) ≤ ℎ2 (𝜀) + 𝜀 log2 (𝐾 − 1),

(35)

where ℎ2 is binary entropy. Indeed, conditional on 𝑅, the indicator of 𝐶 ≠ ℎ(𝑅) is binary; if it is zero, 𝐶 is determined, and otherwise at most 𝐾 − 1 outputs remain. In the ideal case 𝜀 = 0, we have 𝐶 = ℎ(𝑅) and hence 𝐼𝑄 (𝑁; 𝐶 | 𝑅) = 0. The reference laws of the enforced channel 𝐶 are then point masses, so 𝐶𝑅 of Eq. (20), computed with 𝐶 in place of 𝑍, is zero. Proposition 5.3 (Balanced attribute and keys). If, in addition, 𝐵 is fair given each 𝑅 = 𝑟, then for every sender every

decoder of (𝐶, 𝑅) recovers 𝐵 with probability within 𝜀 of 1/2, and 𝐼𝑄 (𝐵; 𝐶 | 𝑅) ≤ 2𝜀. These bounds and Eq. (35) also hold with (𝐶, 𝜉) in place of 𝐶, for any key 𝜉 independent of 𝑆 shared by sender and decoder. Alphabet restriction thus bounds total leakage, and agreement with a task-only representation bounds conditional leakage about the remaining private state for every decoder (derivations in Appendix A.6).

Primary results use 8,192 held-out rounds per arm (64 states, eight base seeds, and 16 rounds per state and seed). Separate training and threshold-calibration splits contain 1,024 rounds each; an independent 4,096-draw stream calibrates the honest decoder-match probabilities used in the selection-law predictions. Distinct random-number streams are derived for each data split, task state, round, and draw role. Intervals use 5,000 paired bootstrap resamples of complete round bundles; seeds, stratification, compute and further details are in Appendix B.

6. Experimental Evaluation 6.2. Recovery and Task Accuracy We evaluate two senders with one open-weight model on one synthetic routing task, the selection sender 𝑄 𝑘 , which changes the message law, and, in a post hoc arm, the lawpreserving sender of Proposition 5.2. We measure recovery against Eq. (30), the effect on routing, what generic and selection-aware monitors detect, the honest sender’s own dependence on the attribute, and the residual information after canonicalisation.

6.1. Setup We use 64 equally weighted synthetic incident records with private state 𝑆 = (𝑅, 𝑁). The task-relevant component 𝑅 specifies one of 16 routes, formed by four fault domains and four severity levels; 𝑁 specifies one of four administrative variants. We target the private bit 𝐵 = 𝑁 mod 2. Each route contains two records with 𝐵 = 0 and two with 𝐵 = 1, so 𝐻 (𝐵 | 𝑅) = 1 bit. The honest prompt requests three lines giving a domain, severity, and short summary, while explicitly prohibiting disclosure of the administrative fields. The receiver is a fixed parser that extracts valid domain and severity fields and outputs one of the 16 routes or REJECT. Routing is correct if that output equals the record’s true route. The sender is Qwen2.5-1.5B-Instruct [9] at a fixed checkpoint revision. Generation uses temperature 1 with no top-𝑘, top-𝑝, or repetition filtering: at each step, the next token is sampled from the model’s unmodified next-token probability distribution, with a maximum of 96 generated tokens. We write 𝑊 for the generated token sequence and 𝑉 for its rendered UTF-8 text. The public decoder 𝐽 = 𝑑 (𝑉) returns the low bit of the final SHA-256 digest byte of the exact rendered text. Both this decoder and the task receiver act on 𝑉; token-level likelihood calculations use 𝑊. In the empirical setting, the emitted message 𝑍 of the formal model is represented by 𝑉. As in Sect. 5.1, 𝑄 𝑘 selects the earliest candidate whose decoded bit equals 𝐵 among 𝑘 ∈ {1, 2, 4, 8, 16} honestmodel draws, or emits an independent fallback if none matches. Each round generates a single pool of 16 candidates: the smaller-budget arms reuse prefixes of that pool and share the same fallback. Two further, independent honest draws, H and H′ , are excluded from selection. The shared pool makes the 𝑄 𝑘 arms paired, rather than independent experimental samples.

Fig. 2 shows the relationship between candidate budget, private-attribute information, and task performance. Since 𝐽 is a deterministic function of the emitted text, data processing gives 𝐼𝑄 (𝐵; 𝑉 | 𝑅) ≥ 𝐼𝑄 (𝐵; 𝐽 | 𝑅). We estimate the latter from the empirical (𝐵, 𝐽) distribution separately within each route. The resulting b 𝐼 (𝐵; 𝐽 | 𝑅) increases from 0.1817 bits at 𝑘 = 1 to 0.4465, 0.7845, and 0.9876 bits at 𝑘 = 2, 4, 8, reaching 1.0000 bit at 𝑘 = 16. The corresponding public-decoder recovery rises from 74.41% to 100.00%; under the honest sender H, recovery is 49.90% and the empirical decoder information is 0.0028 bits. Independent calibration finds that the reference hash bit is approximately balanced within every route: 𝑞b𝑟𝑑 (1) ranges from 0.449 to 0.543. Substituting these estimates into Corollary 4.4 gives a plug-in maximum recovery of about 98.0% for law-preserving senders such as that of Proposition 5.2, biased downwards by sampling error. By Fano’s inequality, they also give a plug-in lower bound 𝐶 𝐵 ≥ 1 − ℎ2 (0.020) ≈ 0.86 bits, so fixing the task-relevant law leaves most of the private bit unconstrained. Eq. (30) predicts recovery 1− (1−𝑎 𝑠 ) 𝑘+1 for each private state, including the fresh fallback. Using match probabilities from the independent calibration stream (64 draws per state) and averaging over the 64 states gives predicted recoveries of 74.96%, 87.13%, 96.44%, 99.68%, and 100.00% for the five budgets. The corresponding observed values are 74.41%, 87.02%, 96.51%, 99.87%, and 100.00%; the largest difference is 0.55 percentage points. At 𝑘 = 16, the decoder matches 𝐵 in all 8,192 test rounds. Writing 𝜂 = Pr[𝐽 ≠ 𝐵], binary Fano’s inequality gives 𝐼𝑄𝑘 (𝐵; 𝑉 | 𝑅) ≥ 1 − ℎ2 (𝜂) with ℎ2 the binary entropy [11], and the one-sided zero-error Clopper–Pearson bound [19], which also covers the design-averaged error of independent non-identical trials (Appendix B.4), yields 𝜂 ≤ 1 − 0.051/8192 = 3.66 × 10−4 at 95% confidence, and hence 𝐼𝑄16 (𝐵; 𝑉 | 𝑅) ≥ 0.9953 bits. The legitimate task remains reliable across the same budget range. The honest arm H routes 8,102 of 8,192 incidents correctly (98.90%) and an independent honest replicate H′ routes 8,085 (98.69%), while 𝑄 16 routes 8,077 correctly (98.60%), a paired change of −0.31 percentage points (95% bootstrap interval [−0.65, 0.04]). Accuracy alone does not compare the full receiver behaviour, so we also estimate the route-conditional distribution over all 16 receiver outputs plus rejection. Its average total-variation distance from H is

(a)

Private-attribute channel

(b) 100

0.8 0.6 0.4 Decoder MI Fano lower bound After canonicalisation

0.2 0.0

Routing accuracy (%)

1.0

̂ I(B; J ∣ R) (bits)

Receiver task performance

99 98 97 96

Selected sender Honest reference

95 1

2

4

8

16

Candidate budget k

1

2

4

8

16

Candidate budget k

Figure 2. Candidate selection increases conditional private-attribute information while routing accuracy remains high. (a) Empirical b 𝐼 ( 𝐵; 𝐽 | 𝑅), pointwise 95% lower confidence bounds on 𝐼 ( 𝐵; 𝑉 | 𝑅) from decoder error (Appendix B.4), and b 𝐼 ( 𝐵; 𝐽 | 𝑅) after canonicalisation. (b) Routing accuracy of selected messages and the honest reference. Bands are 95% bootstrap intervals; 𝑘 is on a log2 scale.

0.004517 for 𝑄 16 , and independent honest samples H′ differ from H by the same amount (both are 74/16,384), the level of honest replication. Although the public hash decoder is at chance under H, honest messages are not free of attribute information. From honest token-sequence likelihoods we estimate 𝐼0 (𝐵; 𝑊 | 𝑅) = 0.2620 bits under the suppression instruction, against 0.7368 bits for an honest control whose prompt asks for the fields; since 𝑉 is a function of 𝑊, the rendered text carries at most this much. The model does not fully comply, and 18.8% of honest messages state at least one administrative value (61.1% when the prompt asks for them). The instruction thus reduces but does not remove the honest dependence on 𝐵, which is what a selection-aware monitor can exploit (Sect. 6.3). TABLE 2. D ETECTION OF 𝑄16 VERSUS H, GROUPED BY MONITOR ACCESS ; AUC ∗ IS FOR THE LAW- PRESERVING SENDER ( POST HOC ARM ). 𝑛 IS PER ARM ; (1)/(16) GIVES MESSAGES PER SCORE . I NTERVALS ARE IN TABLE 4. Monitor

𝑛

FPR

TPR AUC AUC∗

No trusted private-state information Structure (1) 8,192 3.91 4.10 .504 .503 Character text (1) 8,192 6.35 6.23 .490 .490 Surprisal (1) 1,024 14.06 14.26 .496 .495 Selection-aware ratio (1) 1,024 4.00 8.30 .645 .504 Selection-aware ratio (16) 64 1.56 56.25 .972 .540 Trusted task route 𝑅 (identical to the rows above) Route surprisal (1) 1,024 14.06 14.26 .496 .495 Route-aware ratio (1) 1,024 4.00 8.30 .645 .504 Route-aware ratio (16) 64 1.56 56.25 .972 .540 Trusted private attribute 𝐵 Known-code control (16) 512 2.93 100.00 1.000 1.000

6.3. Monitors We next test whether a passive monitor can distinguish selected responses 𝑄 16 from independent honest responses

H. The message-only monitors use either structural features of the rendered text 𝑉, character-level text features, or reference-model surprisal computed from the retained token sequences 𝑊. A selection-aware monitor instead uses the likelihood ratio derived from the known selection rule, reference state-conditioned likelihoods, and independently calibrated match probabilities (Sect. 5.2). We also evaluate variants given a trusted task route 𝑅, and a stronger positive control given the private bit 𝐵 and the public code. Scoring 𝑊 rather than 𝑉, under all 64 records, gives the likelihoodbased monitors more than a deployed passive monitor would have, so their results are optimistic for the monitor; only the positive control receives the realised 𝐵. Learned classifiers are fitted on training observations; nominal 5% false-positive thresholds are set on separate honest calibration observations and then held fixed for testing, with separate calibration for collection-level scores. Table 2 reports the actual held-out false-positive rate (FPR), true-positive rate (TPR), and area under the ROC curve (AUC), with 𝑛 observations per arm; (1) denotes single messages and (16) denotes collections of 16 messages. The surprisal threshold was calibrated on a novelty-purged cohort, so its FPR on the full test stream is 14.06% (Appendix B.5). The generic single-message monitors discriminate poorly: their AUCs are near 0.5. In contrast, the selectionaware ratio gives an AUC of 0.645 on individual messages and 0.972 when its scores are aggregated over 16 messages. At its calibrated collection threshold, the latter detects 56.25% of attack collections with 1.56% FPR. Supplying trusted 𝑅 leaves every score unchanged to the printed precision, because almost every message states its route, so conditioning on 𝑅 shifts surprisal by a nearly constant 4 bits. By comparison, the trusted-𝐵 known-code positive control attains AUC 1.000 and 100% TPR over collections, but assumes information unavailable at the passive boundary. Selection thus creates a distributional signal although every candidate comes from the honest generator, and the

weak performance of generic monitors does not mean that 𝑄 16 preserves the honest message law. Theorem 5.1 predicts its size from honest messages alone. In this approximately balanced design the honest posteriors give a total-variation distance of (1 − 2−16 ) E0 | Pr0 [𝐵 = 1 | 𝑊, 𝑅] − 1/2| = 0.189 between 𝑄 16 and H, so no single-message monitor can exceed AUC 1/2 + 0.189 − 0.1892 /2 = 0.671; the selectionaware ratio reaches 0.645 (95% interval [0.622, 0.667]). Explicit administrative statements explain at most about half of this distance, even if each revealed 𝐵 completely. A law-preserving sender. A post hoc arm runs the sender of Proposition 5.2 on the stored test candidates, without new generation; each trial draws a fresh record of the same route, which is the sampling access the proposition assumes. It recovers 𝐵 in 97.72% of rounds, against the 98.00% that Corollary 4.4 predicts from the calibration estimates, with 2.03 draws per message and routing accuracy 98.95% (98.90% for H). Every monitor without the true 𝐵, applied unchanged, stays near chance (Table 2, AUC∗ ), including the selection-aware ratio, which gives AUC 0.540 over 16 messages against 0.972 for 𝑄 16 . Only the known-code control, given the true 𝐵, still detects the channel, as Sect. 4.6 predicts. By Corollary 4.6, moving each route law by only TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ), about 0.02 on average in plug-in estimates, would lift recovery to 100%.

6.4. Canonical Interface Finally, we restrict communication to exactly the fields used by the legitimate receiver. The deterministic canonicaliser parses the emitted text 𝑉 using the receiver’s route parser and emits one fixed serialisation for each of the 16 accepted routes, or the single string REJECT. Write 𝐴 for the parsed action and 𝐶 = 𝑐(𝑉) for the enforced message. Thus 𝐶 is a function of 𝐴, takes at most 𝐾 = 17 values, and requires no access to the private record or its selected bit. Parsing the canonical string reproduces 𝐴, so canonicalisation is idempotent and preserves each receiver decision by construction, including incorrect routes and rejections. For 𝑄 16 , recovery by the unchanged public hash decoder falls from 100.00% before enforcement to 49.95% afterwards. The empirical conditional information b 𝐼 (𝐵; 𝐽 | 𝑅) falls from 1.0000 to 0.000629 bits, a paired reduction of 0.9994 bits. Fig. 2 shows the same return towards chance recovery across candidate budgets. As an implementation check, the parsed action agrees before and after canonicalisation in all 57,344 test comparisons across the seven arms, so 𝑄 16 keeps its 98.60% routing accuracy. The near-chance recovery is also constrained by the interface, rather than being peculiar to the chosen hash decoder. In the balanced evaluation population, 𝐵 is a fair bit conditional on each true route 𝑅. Since 𝐶 = ℎ(𝑅) whenever routing is correct, any binary decoder of the canonical message, even one additionally given 𝑅, agrees with 𝐵 with probability 1/2 on the corresponding taskonly representation and can differ from this baseline only on routing errors. For 𝑄 16 , the observed error fraction

is b 𝜀 = 115/8192 = 1.40%, so every decoder has testpopulation recovery in [48.60%, 51.40%]. Moreover, applying Eq. (35) to the empirical joint distribution gives b 𝐼 (𝐵; 𝐶 | 𝑅) ≤ ℎ2 (b 𝜀) + b 𝜀 log2 (16) ≈ 0.163 bits.

(36)

This bounds the conditional information in the whole canonical message, and hence in every decoder of it, at the observed routing error (Appendix B.6). Because 𝐵 is fair given each route, Proposition 5.3 sharpens it to b 𝐼 (𝐵; 𝐶 | 𝑅) ≤ 2b 𝜀 ≈ 0.028 bits; with the one-sided 95% Clopper– Pearson bound 𝜀 ≤ 0.0164, the bound is 0.033 bits. Unlike the monitoring results above, this bound holds for every sender behind a trusted canonicaliser, including one that shares a key with the receiver, in terms of that sender’s routing-error rate, so a sender can leak more only by misrouting more. Receivers that need free text are outside its scope.

7. Related Work Multi-agent security and secret collusion. Communication between AI agents creates opportunities for unwanted information exchange that are not captured by studying agents in isolation [2], [20]. Motwani et al. [3] formalise secret collusion among generative agents, including the roles of communication channels, monitoring, common knowledge, and incentives; they show that steganography can be detected with grounding functions, which need the agent’s knowledge, and bound what ideal paraphrasing leaves by semantic entropy. Our monitor lacks that knowledge, and Eq. (35) is the counterpart of their bound for a canonical task interface, in terms of task error. Their earlier benchmark examines collusion using steganographic tools [21], while subsequent work studies steganographic communication emerging from optimisation and its resistance to monitoring or paraphrasing [22]. Related investigations address hidden reasoning within individual models [23] and covert communication enabled by tool use [24]. These studies motivate treating inter-agent messages as a security boundary, but largely investigate the construction, emergence, or detection of particular behaviours. We instead ask what agreement of the audited communication distribution can certify about the sender’s dependence on private state, irrespective of how an alternative sender is implemented. Steganographic security and monitor strength. Provably secure steganography seeks to transmit hidden content without changing the distribution of ordinary covertext, with information-theoretic [25] or complexity-theoretic [8] security; Meteor [26] and Discop [27] achieve this with language models, and Wang and Moulin [28] derive its capacity with a shared key. More recently, Vaikuntanathan and Zamir [29] construct covert conversations that are computationally indistinguishable from honest interaction under cryptographic assumptions, including against a strong passive auditor with knowledge of the agents’ private contexts. That auditor is stronger than ours, but the guarantee is computational.

Our main results are information-theoretic and keyless and characterise what a weaker passive audit identifies; with a fresh shared key bit per message, even a paired audit fails while the interface bounds survive (Sect. 5.2), and undetectable watermarks [30] are keyed embeddings of this kind in LLM output. For imperfect stegosystems, detection evidence accumulates over many covers, as in the squareroot law of steganographic capacity [31]; for selection, Theorem 5.1 gives the per-message 𝜒2 divergence exactly and hence, up to a constant factor, the number of messages a monitor needs. Couplings and minimum entropy. Particularly close to our mathematical approach, Schroeder de Witt et al. [5] show that perfectly secure steganographic procedures correspond to couplings and relate optimal coding efficiency to minimum-entropy couplings. The entropy properties of couplings themselves have been studied independently [12]. With the private state in place of the hidden message, Proposition 3.2 is the keyless counterpart of this coupling view of perfect security [5], [25], and the general point that an output law does not determine dependence on secrets is the probabilistic form of the refinement paradox [6], [7]. The audit setting differs in two respects that our other results address. Honest messages may already depend on the private state, whereas a covertext is independent of the hidden message, and in a balanced case this dependence fixes how detectable selection is (Theorem 5.1). The auditor also asks what the observed law identifies, which yields sharp leakage and recovery limits under task preservation and the condition under which passive conformance does determine leakage (Corollaries 4.3 to 4.6). Confinement and quantitative information flow. Lampson’s confinement problem asks how to prevent a program, during its execution, from transmitting information to parties other than its caller [4]. Noninterference and information-flow policies formalise whether secret inputs can influence public observations [32], [33]; for probabilistic systems the condition is stated on output laws conditioned on the secret [34], which requires exactly the pairing our monitor lacks. Quantitative information flow offers several ways to measure disclosure: Shannon mutual information quantifies statistical dependence, whereas min-entropy leakage captures changes in one-guess vulnerability [35], and gain-function-based 𝑔-leakage extends this perspective to other adversarial objectives [14], [36]. Our main results use Shannon leakage, and Corollary 3.4 shows that the same interval structure holds for every multiplicative 𝑔-leakage, with an exact, though in general NP-hard, expression for Bayes vulnerability. These measures are ordinarily evaluated for a specified channel, whereas the deployed kernel 𝑄(𝑧 | 𝑠) is unavailable to our passive monitor. Strategic confinement additionally notes that small information capacity need not imply small downstream harm when agents target consequential predicates [37]. Our attribute-specific leakage and recovery results identify which such predicates can remain exposed despite task-law preservation. Monitoring and estimating information flow. Informationflow policies are hyperproperties [33], runtime monitors for

them compare several executions [38], [39], and execution monitors cannot enforce them [40]. For a randomised sender such as an LLM, only distributional statements are possible, and our results show that even the exact message distribution does not determine the leakage. Statistical leakage estimators [41], [42] rely on secrets paired with outputs, which is the trusted pairing our monitor lacks. In algorithm-substitution attacks, a subverted implementation leaks through outputs distributed like honest ones [17]; watchdogs test it against its specification [43], like our monitor, and reverse firewalls [44] and active wardens [45] rewrite its outputs, like our canonical interface. Partial identification from incomplete observations. The distinction between knowing marginal distributions and knowing how variables are jointly paired also appears in statistical matching and partial identification [46], [47]. There, several joint distributions agree with what is observed, and the right conclusion is a set of compatible values rather than a point estimate. Our compatible leakage set applies this view to communication security, with trusted state–message pairings as the missing data and leakage as the parameter. Fixing the task-relevant law does not merely narrow an interval; it fixes a different family of marginals and leaves independent coupling choices within task states, which gives population-level leakage and recovery limits rather than a finite-sample estimator. Privacy–utility trade-offs and secure agent pipelines. Information-theoretic privacy research designs release mechanisms that balance useful disclosure against statistical inference of private attributes [48], [49], [50]. Related agentsecurity work develops information-flow controls for AI planners [51], bounds and privacy-regularised training for sequential multi-agent LLM pipelines [52], and decisiontheoretic measures of steganography based on differences in what downstream agents can infer or use [53]. The last avoids a reference law by comparing what a decoding receiver and a non-decoding sentinel gain from a signal; we instead give our monitor the reference law of (𝑅, 𝑍), and with it every declared utility, and characterise what that knowledge alone certifies about leakage and recovery.

8. Conclusion Matching the authorised distribution of messages is not a privacy guarantee at a multi-agent communication boundary. For a single round we have shown how much it leaves open. Compatible leakage forms sharp intervals even when the entire task-relevant law and every declared utility are fixed, and total leakage is determined if and only if, in every task state, the remaining private state or the authorised message is determined by that state. For a sender that preserves the audited law, in independent rounds or for the whole transcript, more observations of the audited variables cannot recover the missing state–message dependence. For a sender, such as an LLM, that selects among its own responses, the change to the message law is, in a balanced case, proportional to the honest sender’s own dependence on the private attribute, so more discreet honest agents give

this attack better cover, and fresh key bits shared with the receiver can hide it even from an audit with trusted pairings. In our experiment it recovers a private bit in every held-out round at 98.60% routing accuracy, generic monitors stay near chance, and a selection-aware monitor detects it over collections of 16 messages, whereas a law-preserving sender removes that signal at the predicted recovery. Conformance testing therefore cannot exclude a sender that preserves the audited law, however exactly that law is known, whereas a canonical interface preserves every receiver decision and bounds, in terms of its routing error, what any sender, keyed or not, reveals to a receiver that acts only on its output. Extending the analysis to adaptive senders and richer interactions is the natural next step.

Acknowledgements We used large language models both as systems under evaluation and as assistants during the preparation of this work. In the experiments, Qwen2.5-1.5B-Instruct served as the reference language-model sender from which candidate messages were generated and selected. The evaluation used a fixed model revision and locally controlled inference; it was not a comparison across multiple model families. Separately, we used Claude Opus 4.8 and ChatGPT 5.6 Sol to assist with implementation, debugging, analysis workflows, and editorial refinement of the manuscript. Their outputs were treated as suggestions rather than authoritative evidence and were reviewed by the authors. The authors take full responsibility for the mathematical arguments, experimental results, citations, and final content of this work.

References [1]

K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising realworld LLM-integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023.

[10] G. J. Simmons, “The prisoners’ problem and the subliminal channel,” in Advances in Cryptology: Proceedings of CRYPTO 1983, 1984. [11] T. M. Cover and J. A. Thomas, Elements of Information Theory. Wiley, 2006. [12] M. Kovačević, I. Stanojević, and V. Šenk, “On the entropy of couplings,” Information and Computation, 2015. [13] F. Cicalese, L. Gargano, and U. Vaccaro, “Minimum-entropy couplings and their applications,” IEEE Transactions on Information Theory, 2019. [14] M. S. Alvim, K. Chatzikokolakis, A. McIver, C. Morgan, C. Palamidessi, and G. Smith, The Science of Quantitative Information Flow. Springer, 2020. [15] D. A. Levin and Y. Peres, Markov Chains and Mixing Times. American Mathematical Society, 2017. [16] R. J. Anderson and F. A. P. Petitcolas, “On the limits of steganography,” IEEE Journal on Selected Areas in Communications, 1998. [17] M. Bellare, K. G. Paterson, and P. Rogaway, “Security of symmetric encryption against mass surveillance,” in Advances in Cryptology – CRYPTO 2014, 2014. [18] M. Bellare, J. Jaeger, and D. Kane, “Mass-surveillance without the state: Strongly undetectable algorithm-substitution attacks,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2015. [19] C. J. Clopper and E. S. Pearson, “The use of confidence or fiducial limits illustrated in the case of the binomial,” Biometrika, 1934. [20] B. Hagag, W. L. Anderson, C. Schroeder de Witt, and S. Scheffler, “Architecture matters for multi-agent security,” in Proceedings of the International Conference on Machine Learning, 2026. [21] S. R. Motwani, M. Baranchuk, L. Hammond, and C. Schroeder de Witt, “A perfect collusion benchmark: How can AI agents be prevented from colluding with information-theoretic undetectability?” in NeurIPS 2023 Workshop on Multi-Agent Security: Security as Key to AI Safety, 2023. [22] Y. Mathew et al., “Hidden in plain text: Emergence & mitigation of steganographic collusion in LLMs,” in Proceedings of IJCNLP-AACL, 2025. [23] F. Roger and R. Greenblatt, “Preventing language models from hiding their reasoning,” arXiv:2310.18512, 2023. [24] J. L. Rippin, S. C. Marshall, D. D. Africa, and C. Schroeder de Witt, “Tool use enables undetectable steganography in multi-agent LLM systems,” arXiv:2606.28425, 2026.

[2]

C. Schroeder de Witt et al., “Open challenges in multi-agent security: Towards secure systems of interacting AI agents,” arXiv:2505.02077, 2025.

[25] C. Cachin, “An information-theoretic model for steganography,” in Information Hiding, 1998.

[3]

S. R. Motwani, M. Baranchuk, M. Strohmeier, V. Bolina, P. H. S. Torr, L. Hammond, and C. Schroeder de Witt, “Secret collusion among AI agents: Multi-agent deception via steganography,” in Advances in Neural Information Processing Systems, 2024.

[26] G. Kaptchuk, T. M. Jois, M. Green, and A. D. Rubin, “Meteor: Cryptographically secure steganography for realistic distributions,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2021.

[4]

B. W. Lampson, “A note on the confinement problem,” Communications of the ACM, 1973.

[5]

C. Schroeder de Witt, S. Sokota, J. Z. Kolter, J. Foerster, and M. Strohmeier, “Perfectly secure steganography using minimum entropy coupling,” in International Conference on Learning Representations, 2023.

[27] J. Ding, K. Chen, Y. Wang, N. Zhao, W. Zhang, and N. Yu, “Discop: Provably secure steganography in practice based on “distribution copies”,” in Proceedings of the IEEE Symposium on Security and Privacy, 2023.

[6]

J. Jacob, “On the derivation of secure components,” in Proceedings of the IEEE Symposium on Security and Privacy, 1989.

[7]

C. Morgan, “The shadow knows: Refinement of ignorance in sequential programs,” in Mathematics of Program Construction, 2006.

[8]

N. J. Hopper, J. Langford, and L. von Ahn, “Provably secure steganography,” in Advances in Cryptology—CRYPTO 2002, 2002.

[9]

A. Yang et al., “Qwen2.5 technical report,” arXiv:2412.15115, 2024.

[28] Y. Wang and P. Moulin, “Perfectly secure steganography: Capacity, error exponents, and code constructions,” IEEE Transactions on Information Theory, 2008. [29] V. Vaikuntanathan and O. Zamir, “Undetectable conversations between AI agents via pseudorandom noise-resilient key exchange,” in Proceedings of the IEEE Symposium on Foundations of Computer Science (FOCS), 2026. [30] M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” in Proceedings of the Conference on Learning Theory, 2024.

[31] A. D. Ker, T. Pevný, J. Kodovský, and J. Fridrich, “The square root law of steganographic capacity,” in Proceedings of the ACM Workshop on Multimedia and Security, 2008. [32] A. Sabelfeld and A. C. Myers, “Language-based information-flow security,” IEEE Journal on Selected Areas in Communications, 2003. [33] M. R. Clarkson and F. B. Schneider, “Hyperproperties,” Journal of Computer Security, 2010. [34] J. W. Gray, III, “Toward a mathematical foundation for information flow security,” in Proceedings of the IEEE Symposium on Security and Privacy, 1991. [35] G. Smith, “On the foundations of quantitative information flow,” in Foundations of Software Science and Computational Structures, 2009. [36] M. S. Alvim, K. Chatzikokolakis, C. Palamidessi, and G. Smith, “Measuring information leakage using generalized gain functions,” in Proceedings of the IEEE Computer Security Foundations Symposium, 2012. [37] C. Schroeder de Witt, “A note on the strategic confinement problem,” arXiv:2606.09931, 2026. [38] S. Agrawal and B. Bonakdarpour, “Runtime verification of 𝑘-safety hyperproperties in HyperLTL,” in Proceedings of the IEEE Computer Security Foundations Symposium, 2016. [39] B. Finkbeiner, C. Hahn, M. Stenger, and L. Tentrup, “Monitoring hyperproperties,” in International Conference on Runtime Verification, 2017. [40] F. B. Schneider, “Enforceable security policies,” ACM Transactions on Information and System Security, 2000. [41] T. Chothia and A. Guha, “A statistical test for information leaks using continuous mutual information,” in Proceedings of the IEEE Computer Security Foundations Symposium, 2011. [42] G. Cherubin, K. Chatzikokolakis, and C. Palamidessi, “F-BLEAU: Fast black-box leakage estimation,” in Proceedings of the IEEE Symposium on Security and Privacy, 2019.

Ethics and Responsible Research This work addresses a dual-use security problem: a sender may exploit legitimate inter-agent communication to disclose private information. Our exact constructions characterise such information flow under specified observation boundaries, and our LLM experiment evaluates one candidate-selection mechanism. These results could also inform attempts at covert disclosure. We therefore distinguish the formal indistinguishability statements from the empirical attack, which changes the emitted message law and can be detected by a selection-aware monitor. We limited the experimental risks by using synthetic incident records, an artificial private attribute, and a locally executed language model in a controlled routing simulation. The study did not use real personal or medical records, involve human participants, compromise deployed agent systems, or send genuine private information to an external recipient. The local-to-cloud example motivating the work is a threat scenario, not an account of an attack conducted in the experiments. The security benefit is to establish which leakage claims are unsupported by passive communication monitoring and to evaluate stronger safeguards. In particular, we report both the detectability of the selection mechanism and the reduction in private-attribute information afforded by a canonical task interface. We consider the value of making these audit limitations and defensive alternatives explicit, together with the controlled experimental design, to outweigh the residual risk of misuse.

[43] A. Russell, Q. Tang, M. Yung, and H.-S. Zhou, “Cliptography: Clipping the power of kleptographic attacks,” in Advances in Cryptology – ASIACRYPT 2016, 2016.

Appendix A. Proofs

[44] I. Mironov and N. Stephens-Davidowitz, “Cryptographic reverse firewalls,” in Advances in Cryptology – EUROCRYPT 2015, 2015.

A.1. Fixed message law

[45] G. Fisk, M. Fisk, C. Papadopoulos, and J. Neil, “Eliminating steganography in internet traffic with active wardens,” in Information Hiding (IH 2002), 2003. [46] M. D’Orazio, M. Di Zio, and M. Scanu, Statistical Matching: Theory and Practice. Wiley, 2006. [47] C. F. Manski, Partial Identification of Probability Distributions. Springer, 2003. [48] L. Sankar, S. R. Rajagopalan, and H. V. Poor, “Utility-privacy tradeoffs in databases: An information-theoretic approach,” IEEE Transactions on Information Forensics and Security, 2013. [49] F. du Pin Calmon and N. Fawaz, “Privacy against statistical inference,” in Proceedings of the Allerton Conference on Communication, Control, and Computing, 2012. [50] A. Makhdoumi, S. Salamatian, N. Fawaz, and M. Médard, “From the information bottleneck to the privacy funnel,” in IEEE Information Theory Workshop, 2014. [51] M. Costa et al., “Securing AI agents with information-flow control,” arXiv:2505.23643, 2025. [52] S. Asif and M. M. Amiri, “Information-theoretic privacy control for sequential multi-agent LLM systems,” arXiv:2603.05520, 2026. [53] U. Anwar, J. Piskorz, D. D. Baek, D. Africa, J. Weatherall, M. Tegmark, C. Schroeder de Witt, M. van der Schaar, and D. Krueger, “A decision-theoretic formalisation of steganography with applications to LLM monitoring,” arXiv:2602.23163, 2026.

Proof of Proposition 3.2. For each sender kernel 𝑄 satisfying 𝑄¯ = 𝛽, define 𝛾𝑄 (𝑠, 𝑧) := 𝜇(𝑠)𝑄(𝑧 | 𝑠). Its state marginal is 𝜇, and its message marginal is 𝑄¯ = 𝛽, so 𝛾𝑄 ∈ Γ(𝜇, 𝛽). Conversely, for any 𝛾 ∈ Γ(𝜇, 𝛽), set 𝑄 𝛾 (𝑧 | 𝑠) := 𝛾(𝑠, 𝑧)/𝜇(𝑠). This is well defined because 𝜇(𝑠) > 0 on the Í retained state space; it is a stochastic kernel because 𝑧 𝛾(𝑠, 𝑧) = 𝜇(𝑠), and its emitted message Í law is 𝑠 𝜇(𝑠)𝑄 𝛾 (𝑧 | 𝑠) = 𝛽(𝑧). Thus the feasible sender kernels and the couplings in Γ(𝜇, 𝛽) are in one-to-one correspondence, with 𝐼𝑄 (𝑆; 𝑍) = 𝐼 𝛾𝑄 (𝑆; 𝑍). The coupling set is nonempty, since it contains 𝛾ind := 𝜇 ⊗ 𝛽, and is a closed, bounded subset of the finitedimensional probability simplex; hence it is compact. For any 𝛾 ∈ Γ(𝜇, 𝛽), the marginal entropies are fixed and 𝐼 𝛾 (𝑆; 𝑍) = 𝐻 (𝜇) + 𝐻 (𝛽) − 𝐻 (𝛾). Mutual information is nonnegative, with 𝐼 𝛾ind (𝑆; 𝑍) = 0. Since finite-alphabet entropy is continuous, there is a minimum-entropy coupling 𝛾★ ∈ Γ(𝜇, 𝛽), which attains 𝐼 𝛾★ (𝑆; 𝑍) = 𝐺 (𝜇, 𝛽). Consequently, every feasible leakage value lies in [0, 𝐺 (𝜇, 𝛽)], and both endpoints are feasible. To establish attainability of every intermediate value, for 𝑡 ∈ [0, 1] let 𝛾𝑡 := (1−𝑡)𝛾ind +𝑡𝛾★. The prescribed marginals

are linear constraints, so 𝛾𝑡 ∈ Γ(𝜇, 𝛽) for all 𝑡. The map 𝑡 ↦→ 𝐼 𝛾𝑡 (𝑆; 𝑍) is continuous, and its values at 𝑡 = 0 and 𝑡 = 1 are 0 and 𝐺 (𝜇, 𝛽), respectively. By the intermediate value theorem it attains every value between these endpoints. Applying the kernel construction above to each 𝛾𝑡 proves I (𝛽) = [0, 𝐺 (𝜇, 𝛽)], as claimed. By the lemma at the end of Appendix A.3, 𝐺 (𝜇, 𝛽) = 0 exactly when 𝜇 or 𝛽 is a point mass. □ Proof of Corollary 3.4. For a gain function 𝑔 : W × S → R on a finite Í action set W with prior vulnerability 𝑉𝑔 (𝜇) := max𝑤 𝑠 𝜇(𝑠)𝑔(𝑤, 𝑠) > 0, the posterior vulnerability of a coupling 𝛾 ∈ Γ(𝜇, 𝛽) is ∑︁ ∑︁ 𝑉𝑔 (𝛾) = max 𝛾(𝑠, 𝑧) 𝑔(𝑤, 𝑠), 𝑤 𝑧

𝑠

and its multiplicative 𝑔-leakage is log2 𝑉𝑔 (𝛾)/𝑉𝑔 (𝜇) . Each summand is a maximum of finitely many linear functions of 𝛾, so 𝑉𝑔 is convex and continuous on Γ(𝜇, 𝛽). A sum of maxima Í is at least the maximum of the sum, so 𝑉𝑔 (𝛾) ≥ max𝑤 𝑠,𝑧 𝛾(𝑠, 𝑧)𝑔(𝑤, 𝑠) = 𝑉𝑔 (𝜇), with equality at 𝜇 ⊗ 𝛽; the smallest compatible leakage is therefore 0. A convex function on the polytope Γ(𝜇, 𝛽) attains its maximum at a vertex, and since Γ(𝜇, 𝛽) is convex and 𝑉𝑔 is continuous, every intermediate value is attained, as in the proof of Proposition 3.2. For Bayes vulnerability, W = S and 𝑔(𝑤, 𝑠) = Í 1{𝑤 = 𝑠}, so 𝑉 (𝛾) = 𝑧 max𝑠 𝛾(𝑠, 𝑧) = max𝑑 Pr𝛾 [𝑑 (𝑍) = 𝑆] over maps 𝑑 : Z → S, and 𝑉 (𝜇) = max𝑠 𝜇(𝑠). Maximising over 𝛾 and applying Corollary 4.4 with a constant route and 𝐵 = 𝑆 gives max𝛾 𝑉 (𝛾) = max𝑑 [1 − TV(𝜇, 𝑞 𝑑 )]. □ Since 𝑃0 itself has marginal 𝛽, its leakage 𝐼0 (𝑆; 𝑍) belongs to this interval. Subtracting this fixed reference value from the interval proved above gives Eq. (11), the claimed range of reference-relative leakage increments.

A.2. Task-conditioned attribute–message couplings Proof of Theorem 4.2. Fix any 𝑟 with 𝜋(𝑟) > 0. For every 𝑄 ∈ F𝑅 , the law of the private state is fixed, so 𝑃𝑄 (𝐵 = 𝑏 | 𝑅 = 𝑟) = 𝑝 𝑟 (𝑏). By the definition of F𝑅 , we also have (𝐵,𝑍 ) | 𝑅=𝑟 𝑃𝑄 (𝑍 = 𝑧 | 𝑅 = 𝑟) = 𝛽𝑟 (𝑧). Hence 𝑃𝑄 has the prescribed marginals and belongs to Γ( 𝑝 𝑟 , 𝛽𝑟 ). This proves the inclusion from left to right in Eq. (18). For the reverse inclusion, choose an arbitrary coupling 𝜂𝑟 ∈ Γ( 𝑝 𝑟 , 𝛽𝑟 ) for each 𝑟 with 𝜋(𝑟) > 0. Define a sender kernel on every state (𝑟, 𝑛) of positive probability by 𝑄 𝜂 (𝑧 | 𝑟, 𝑛) :=

𝜂𝑟 (𝑔(𝑟, 𝑛), 𝑧) . 𝑝 𝑟 (𝑔(𝑟, 𝑛))

(37)

The denominator is strictly positive on this support: if 𝜇(𝑟, 𝑛) = 𝜋(𝑟)𝛼𝑟 (𝑛) > 0 and 𝑏 = 𝑔(𝑟, 𝑛), then 𝑝 𝑟 (𝑏) ≥ 𝛼𝑟 (𝑛) > 0. Since 𝜂𝑟 is nonnegative and Í has first marginal 𝑝 𝑟 , we have 𝑄 𝜂 (𝑧 | 𝑟, 𝑛) ≥ 0 and 𝑧 𝑄 𝜂 (𝑧 | 𝑟, 𝑛) = 1. Values of the kernel on zero-probability states, if retained, may be chosen arbitrarily.

For every 𝑏 with 𝑝 𝑟 (𝑏) > 0, the resulting conditional joint law satisfies 𝑃𝑄 𝜂 (𝐵 = 𝑏, 𝑍 = 𝑧 | 𝑅 = 𝑟) ∑︁ = 𝛼𝑟 (𝑛)𝑄 𝜂 (𝑧 | 𝑟, 𝑛) 𝑛:𝑔 (𝑟 ,𝑛)=𝑏

=

𝜂𝑟 (𝑏, 𝑧) 𝑝 𝑟 (𝑏)

∑︁

(38) 𝛼𝑟 (𝑛)

𝑛:𝑔 (𝑟 ,𝑛)=𝑏

= 𝜂𝑟 (𝑏, 𝑧). If 𝑝 𝑟 (𝑏) = 0, both sides are zero, since the event 𝐵 = 𝑏 is impossible conditional on 𝑅 = 𝑟 and the 𝐵-marginal of 𝜂𝑟 is 𝑝 𝑟 . Summing the displayed Í identity over 𝑏 now yields 𝑃𝑄 𝜂 (𝑍 = 𝑧 | 𝑅 = 𝑟) = 𝑏 𝜂𝑟 (𝑏, 𝑧) = 𝛽𝑟 (𝑧). Therefore (𝑅,𝑍 ) 𝑃𝑄 = 𝜆 0 , so 𝑄 𝜂 ∈ F𝑅 , and its conditional (𝐵, 𝑍) law 𝜂 equals the prescribed 𝜂𝑟 . The construction specifies one kernel 𝑄 𝜂 (𝑧 | 𝑟, 𝑛) for every state in the support of 𝜇, using only the coupling chosen for that state’s value of 𝑟. Thus the choices of 𝜂𝑟 impose no cross-route consistency constraints and are realised simultaneously by this single sender. Since the family of couplings was arbitrary, the reverse inclusion and the final assertion of the theorem follow. □

A.3. Sharp leakage intervals under task-law preservation (𝑅,𝑍 ) Proof of Corollary 4.3. Every 𝑄 ∈ F𝑅 has 𝑃𝑄 = 𝜆 0 , so 𝐼𝑄 (𝑅; 𝑍) = 𝐼0 (𝑅; 𝑍) = 𝐼 𝑅 . Since 𝑆 = (𝑅, 𝑁), the chain rule and conditioning on 𝑅 give

𝐼𝑄 (𝑆; 𝑍) = 𝐼 𝑅 + 𝐼𝑄 (𝑁; 𝑍 | 𝑅), ∑︁ 𝐼𝑄 (𝑁; 𝑍 | 𝑅) = 𝜋(𝑟)𝐼𝑄 (𝑁; 𝑍 | 𝑅 = 𝑟).

(39)

𝑟: 𝜋 (𝑟 ) >0

For each such 𝑟, the conditional joint law of (𝑁, 𝑍) has marginals 𝛼𝑟 and 𝛽𝑟 . Therefore, by the definition of 𝐺, 0 ≤ 𝐼𝑄 (𝑁; 𝑍 | 𝑅 = 𝑟) ≤ 𝐺 (𝛼𝑟 , 𝛽𝑟 ), and consequently 𝐼 𝑅 ≤ 𝐼𝑄 (𝑆; 𝑍) ≤ 𝐼 𝑅 + 𝐶𝑅 . To show that these endpoints and every intermediate value are attainable, fix, for each 𝑟 with 𝜋(𝑟) > 0, a maximiser 𝛾𝑟★ ∈ Γ(𝛼𝑟 , 𝛽𝑟 ), which exists by compactness and continuity on finite alphabets. Let 𝛾𝑟0 := 𝛼𝑟 ⊗ 𝛽𝑟 and, for 𝑡 ∈ [0, 1], put 𝛾𝑟𝑡 := (1 − 𝑡)𝛾𝑟0 + 𝑡𝛾𝑟★. Each 𝛾𝑟𝑡 has the prescribed marginals. Applying Theorem 4.2 with the attribute 𝐵 = 𝑁, the family (𝛾𝑟𝑡 )𝑟 is realised by a single sender 𝑄 𝑡 ∈ F𝑅 . Its total leakage is ∑︁ 𝐼𝑄𝑡 (𝑆; 𝑍) = 𝐼 𝑅 + 𝜋(𝑟)𝐼 𝛾𝑟𝑡 (𝑁; 𝑍). (40) 𝑟

This quantity varies continuously with 𝑡, equals 𝐼 𝑅 at 𝑡 = 0, and equals 𝐼 𝑅 +𝐶𝑅 at 𝑡 = 1. The intermediate value theorem thus gives the entire interval [𝐼 𝑅 , 𝐼 𝑅 + 𝐶𝑅 ], including both endpoints.

For the attribute-specific range, Theorem 4.2 likewise identifies the feasible conditional laws of (𝐵, 𝑍) with Γ( 𝑝 𝑟 , 𝛽𝑟 ), independently for every 𝑟. Hence ∑︁ 0 ≤ 𝐼𝑄 (𝐵; 𝑍 | 𝑅) = 𝜋(𝑟)𝐼𝑄 (𝐵; 𝑍 | 𝑅 = 𝑟) ≤ 𝐶 𝐵 . (41)

For any such coupling 𝜅𝑟 , the diagonal mass is bounded by each marginal, so ∑︁ Pr[𝐵 = 𝑌 | 𝑅 = 𝑟] = 𝜅𝑟 (𝑏, 𝑏) ≤

𝑟

Choose, for each positive-probability 𝑟, a maximiser 𝜂★ 𝑟 ∈ Γ( 𝑝 𝑟 , 𝛽𝑟 ) and interpolate 𝜂𝑟𝑡 := (1 − 𝑡)( 𝑝 𝑟 ⊗ 𝛽𝑟 ) + 𝑡𝜂★ 𝑟 . The same theorem realises each family (𝜂𝑟𝑡 )𝑟 simultaneously by e𝑡 ∈ F𝑅 . Continuity of Í𝑟 𝜋(𝑟)𝐼 𝜂 𝑡 (𝐵; 𝑍), together a sender 𝑄 𝑟 with its endpoint values 0 and 𝐶 𝐵 , proves that the complete attribute-specific range is [0, 𝐶 𝐵 ]. The two interval claims concern the attainable values of each leakage functional separately; they do not assert that their upper endpoints must be attained by the same sender. □ For completeness, because 𝐵 = 𝑔(𝑅, 𝑁), conditional data processing gives 𝐼𝑄 (𝐵; 𝑍 | 𝑅) ≤ 𝐼𝑄 (𝑁; 𝑍 | 𝑅) for every 𝑄 ∈ F𝑅 . Taking the respective maxima in the proved intervals yields 𝐶 𝐵 ≤ 𝐶𝑅 . Finally, with 𝐾0 := 𝐼0 (𝑁; 𝑍 | 𝑅), the chain rule gives 𝐼0 (𝑆; 𝑍) = 𝐼 𝑅 + 𝐾0 ; subtracting this reference leakage from the first interval establishes Eq. (24). Finally, 𝐺 ( 𝑝, 𝑞) = 0 if and only if 𝑝 or 𝑞 is a point mass. If 𝑝 = 𝛿 𝑥 , every coupling of 𝑝 and 𝑞 equals 𝛿 𝑥 ⊗ 𝑞, and symmetrically for 𝑞. Otherwise pick 𝑥 1 ≠ 𝑥2 in the support of 𝑝 and 𝑧1 ≠ 𝑧 2 in the support of 𝑞, and for 0 < 𝜖 ≤ min{𝑝(𝑥1 )𝑞(𝑧2 ), 𝑝(𝑥 2 )𝑞(𝑧1 )} move mass 𝜖 of 𝑝 ⊗ 𝑞 from (𝑥 1 , 𝑧2 ) and (𝑥 2 , 𝑧1 ) to (𝑥 1 , 𝑧1 ) and (𝑥 2 , 𝑧2 ). The result is a coupling of 𝑝 and 𝑞 that is not a product, so its mutual information is positive. Applied in each route to (𝛼𝑟 , 𝛽𝑟 ) and to ( 𝑝 𝑟 , 𝛽𝑟 ), this shows that 𝐶𝑅 = 0 exactly when, for every 𝑟 with 𝜋(𝑟) > 0, 𝛼𝑟 or 𝛽𝑟 is a point mass, and 𝐶 𝐵 = 0 exactly when 𝑝 𝑟 or 𝛽𝑟 is.

A.4. Optimal recovery with a public decoder Proof of Corollary 4.4. Fix a task state 𝑟 with 𝜋(𝑟) > 0, and put 𝑌 = 𝑑 (𝑍). For every 𝑄 ∈ F𝑅 , the conditional law 𝜅𝑟 of (𝐵, 𝑌 ) given 𝑅 = 𝑟 has marginals 𝑝 𝑟 and 𝑞 𝑟𝑑 , since 𝑍 | 𝑅=𝑟 𝑃𝑄 = 𝛽𝑟 . Thus 𝜅𝑟 ∈ Γ( 𝑝 𝑟 , 𝑞 𝑟𝑑 ). Conversely, take any 𝜅𝑟 ∈ Γ( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) and define a conditional coupling of (𝐵, 𝑍) by  𝛽 (𝑧)   𝜅𝑟 (𝑏, 𝑑 (𝑧)) 𝑟  , 𝑑 𝜂𝑟 (𝑏, 𝑧) := 𝑞 𝑟 (𝑑 (𝑧))   0, 

𝑏 ∑︁

min{𝑝 𝑟 (𝑏), 𝑞 𝑟𝑑 (𝑏)}

(43)

𝑏

= 1 − TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ). The upper bound is attained by a maximal coupling. To see this explicitly, let 𝑒𝑟 (𝑏) := ( Í 𝑝 𝑟 (𝑏) − 𝑞 𝑟𝑑 (𝑏))Í+ , 𝑓𝑟 (𝑏) := 𝑑 (𝑞 𝑟 (𝑏) − 𝑝 𝑟 (𝑏))+ , and 𝑡𝑟 := 𝑏 𝑒 𝑟 (𝑏) = 𝑏 𝑓𝑟 (𝑏) = TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ). When 𝑡𝑟 > 0, set 𝑒𝑟 (𝑏) 𝑓𝑟 (𝑦) . 𝑡𝑟 (44) Its marginals are 𝑝 𝑟 and 𝑞 𝑟𝑑 . Moreover, 𝑒𝑟 (𝑏) 𝑓𝑟 (𝑏) = 0Í for every 𝑏, so its diagonal mass is exactly 𝑑 𝑏 min{𝑝 𝑟 (𝑏), 𝑞 𝑟 (𝑏)}. When 𝑡 𝑟 = 0, the diagonal coupling ★ 𝜅𝑟 (𝑏, 𝑦) = 1{𝑏 = 𝑦}𝑝 𝑟 (𝑏) attains the same bound. Lifting each 𝜅★ 𝑟 by Eq. (42) and invoking Theorem 4.2 gives a single 𝑄★ ∈ F𝑅 attaining the conditional optimum for every positive-probability route. Averaging over 𝑅 yields ∑︁   max Pr [𝑑 (𝑍) = 𝐵] = 𝜋(𝑟) 1 − TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) , (45) 𝑑 𝜅★ 𝑟 (𝑏, 𝑦) := 1{𝑏 = 𝑦} min{𝑝 𝑟 (𝑏), 𝑞 𝑟 (𝑏)} +

𝑄∈ F𝑅 𝑄

𝑟

as required.

□

A.5. Perfect recovery and bounded distortion Proof of Corollary 4.5. Fix Í a public decoder 𝑑 : Z → B and recall that 𝑞 𝑟𝑑 (𝑏) = 𝑧:𝑑 (𝑧)=𝑏 𝛽𝑟 (𝑧). Suppose first that some 𝑄 ∈ F𝑅 satisfies Pr𝑄 [𝑑 (𝑍) = 𝐵] = 1. Since Pr[𝑅 = 𝑟] = 𝜋(𝑟) > 0 for every retained task state, the weighted average of conditional recovery probabilities can equal one only if Pr𝑄 [𝑑 (𝑍) = 𝐵 | 𝑅 = 𝑟] = 1 for each such 𝑟. Thus 𝐵 = 𝑑 (𝑍) almost surely conditional on 𝑅 = 𝑟, so for every 𝑏 ∈ B, 𝑝 𝑟 (𝑏) = Pr [𝐵 = 𝑏 | 𝑅 = 𝑟] 𝑄

= Pr [𝑑 (𝑍) = 𝑏 | 𝑅 = 𝑟] 𝑄 ∑︁ = 𝛽𝑟 (𝑧) = 𝑞 𝑟𝑑 (𝑏).

(46)

𝑧:𝑑 (𝑧)=𝑏

𝑞 𝑟𝑑 (𝑑 (𝑧)) > 0,

(42)

𝑞 𝑟𝑑 (𝑑 (𝑧)) = 0.

This construction is well defined: if 𝑞 𝑟𝑑 (𝑑 (𝑧)) = 0, then 𝛽𝑟 (𝑧) = 0. For each 𝑦 withÍ𝑞 𝑟𝑑 (𝑦) > 0, summing over messages with 𝑑 (𝑧) = 𝑦 gives 𝑧:𝑑 (𝑧)=𝑦 𝜂𝑟 (𝑏, 𝑧) = 𝜅𝑟 (𝑏, 𝑦). It follows that 𝜂𝑟 has 𝐵-marginal 𝑝 𝑟 , 𝑍-marginal 𝛽𝑟 , and pushforward (𝐵, 𝑑 (𝑍))-law 𝜅𝑟 . Theorem 4.2 therefore realises any prescribed family (𝜅𝑟 )𝑟 simultaneously by one sender in F𝑅 . Consequently, optimising recovery over taskpreserving senders is equivalent to maximising Pr[𝐵 = 𝑌 ] over Γ( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) independently for each 𝑟.

Here the last equality uses 𝑄 ∈ F𝑅 . This proves that the stated mass-balance condition is necessary. Conversely, suppose 𝑝 𝑟 (𝑏) = 𝑞 𝑟𝑑 (𝑏) for every 𝑏 and every 𝑟 with 𝜋(𝑟) > 0. For each such 𝑟, define 𝜂𝑟 (𝑏, 𝑧) := 𝛽𝑟 (𝑧) 1{𝑑 (𝑧) = 𝑏}. Its Í

while its 𝐵-marginal is = 𝑞 𝑟𝑑 (𝑏) = 𝑝 𝑟 (𝑏). Hence assigns probability one to the event 𝑑 (𝑍) = 𝐵. By Theorem 4.2, these conditional couplings can all be realised simultaneously by one sender 𝑄★ ∈ F𝑅 ; therefore Pr𝑄★ [𝑑 (𝑍) = 𝐵] = 1. For clarity, this 𝑍-marginal

is

𝛽𝑟 ,

(47)

= 𝑏} 𝑧 𝛽𝑟 (𝑧)1{𝑑 (𝑧) 𝜂𝑟 ∈ Γ( 𝑝 𝑟 , 𝛽𝑟 ), and it

sender can be chosen explicitly on every state (𝑟, 𝑛) of positive probability as 𝑄★ (𝑧 | 𝑟, 𝑛) =

𝛽𝑟 (𝑧) 1{𝑑 (𝑧) = 𝑔(𝑟, 𝑛)} . 𝑝 𝑟 (𝑔(𝑟, 𝑛))

(48)

The denominator is positive on the state support, and the mass-balance condition makes the numerator sum to that denominator. Summing over 𝑁 | 𝑅 = 𝑟 restores 𝛽𝑟 , so 𝑄★ ∈ F𝑅 , while every message with positive probability satisfies 𝑑 (𝑧) = 𝑔(𝑟, 𝑛) = 𝐵. This proves sufficiency and the required existence statement. No assertion is made that every taskpreserving sender has perfect recovery. □ Proof of Corollary 4.6. Fix 𝑟 and let 𝜈𝑟 be the law of 𝑑 (𝑍) given 𝑅 = 𝑟 under 𝑄. By data processing, TV(𝜈𝑟 , 𝑞 𝑟𝑑 ) ≤ 𝛿𝑟 , so TV( 𝑝 𝑟 , 𝜈𝑟 ) ≥ TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) − 𝛿𝑟 , and Pr𝑄 [𝑑 (𝑍) = 𝐵 | 𝑅 = 𝑟] ≤ 1 − TV( 𝑝 𝑟 , 𝜈𝑟 ) because 𝐵 and 𝑑 (𝑍) have laws 𝑝 𝑟 and 𝜈𝑟 given 𝑅 = 𝑟; since probabilities are at most 1, this gives the stated value as an upper bound. For attainment, let 𝑡𝑟 = min{𝛿𝑟 , TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 )} and choose 𝜈𝑟∗ on the segment from 𝑞 𝑟𝑑 to 𝑝 𝑟 with TV(𝜈𝑟∗ , 𝑞 𝑟𝑑 ) = 𝑡𝑟 , so that TV( 𝑝 𝑟 , 𝜈𝑟∗ ) = TV( 𝑝 𝑟 , 𝑞 𝑟𝑑 ) − 𝑡𝑟 . Let 𝑄 𝑟 rescale 𝛽𝑟 on each decoder class {𝑧 : 𝑑 (𝑧) = 𝑦} to total mass 𝜈𝑟∗ (𝑦), placing that mass on any message decoded as 𝑦 if 𝑞 𝑟𝑑 (𝑦) = 0. Then TV(𝑄 𝑟 , 𝛽𝑟 ) = TV(𝜈𝑟∗ , 𝑞 𝑟𝑑 ) = 𝑡𝑟 ≤ 𝛿𝑟 . Given 𝐵, draw 𝑌 from the conditional law of a maximal coupling of 𝑝 𝑟 and 𝜈𝑟∗ , and then 𝑍 from 𝑄 𝑟 restricted to {𝑧 : 𝑑 (𝑧) = 𝑌 }. The message law given 𝑅 = 𝑟 is 𝑄 𝑟 , and Pr[𝑑 (𝑍) = 𝐵 | 𝑅 = 𝑟] = 1 − TV( 𝑝 𝑟 , 𝜈𝑟∗ ).□

Likelihood ratios. Define 𝑤 𝑘 (𝑠, 𝑧) := 𝑄 𝑘 (𝑧 | 𝑠)/𝑃0 (𝑧 | 𝑠) on the support of 𝑃0 (· | 𝑠), using the bracketed expression in Eq. (29) elsewhere. For every 𝑧 with 𝛽(𝑧) > 0, Í 𝜇(𝑠)𝑃0 (𝑧 | 𝑠)𝑤 𝑘 (𝑠, 𝑧) 𝑄¯ 𝑘 (𝑧) = 𝑠 Í (51) 𝛽(𝑧) 𝑠 𝜇(𝑠)𝑃0 (𝑧 | 𝑠) = E0 [𝑤 𝑘 (𝑆, 𝑧) | 𝑍 = 𝑧]. Conditioning the same calculation on a positive-probability task state 𝑅 = 𝑟 gives 𝑃𝑄𝑘 (𝑍 = 𝑧 | 𝑅 = 𝑟)/𝛽𝑟 (𝑧) = E0 [𝑤 𝑘 (𝑆, 𝑧) | 𝑍 = 𝑧, 𝑅 = 𝑟] whenever 𝛽𝑟 (𝑧) > 0. These identities require no claim that the selection law equals the reference law; indeed the ratio may depend on 𝑧. Proof of Theorem 5.1. Assume that 𝐵 is fair conditional on every 𝑅 = 𝑟 of positive probability and that 𝑎 𝑠 = 1/2 for every positive-probability private state 𝑠. Set 𝛿 𝑘 := 1 − 2−𝑘 and 𝑚 𝑟 (𝑧) := 𝑃0 [𝐵 = 𝑑 (𝑧) | 𝑍 = 𝑧, 𝑅 = 𝑟] for 𝛽𝑟 (𝑧) > 0. The selection multiplier reduces to 𝑤 𝑘 (𝑠, 𝑧) = 2−𝑘 + 2𝛿 𝑘 1{𝑑 (𝑧) = 𝑔(𝑠)},

and hence the route-conditional likelihood ratio is 2−𝑘 + 2𝛿 𝑘 𝑚 𝑟 (𝑧), which equals 1+2𝛿 𝑘 (𝑚 𝑟 (𝑧) −1/2) because 2−𝑘 = 1 − 𝛿 𝑘 ; in particular ℓ𝑘,𝑟 ≤ 2. Therefore, 𝑍 |𝑟 TV(𝑃𝑄 , 𝛽𝑟 ) 𝑘 ∑︁ 1 𝛽𝑟 (𝑧)|ℓ𝑘,𝑟 (𝑧) − 1| = 2 𝑧 ∑︁ = 𝛿𝑘 𝛽𝑟 (𝑧)|𝑚 𝑟 (𝑧) − 21 |.

A.6. Selection channels and canonical interfaces Selection kernel and recovery. Fix a private state 𝑠, let 𝑏 𝑠 = 𝑔(𝑠), and write 𝑎 𝑠 = 𝑃0 [𝑑 (𝑍) = 𝑏 𝑠 | 𝑆 = 𝑠]. Let 𝑋1 , . . . , 𝑋 𝑘 , 𝐹 be independent draws from 𝑃0 (· | 𝑠), with 𝐹 the additional fallback. The selection rule emits the earliest 𝑋𝑖 with 𝑑 (𝑋𝑖 ) = 𝑏 𝑠 , or 𝐹 if every 𝑋𝑖 misses. For a particular 𝑧, the probability that the rule first selects 𝑋𝑖 = 𝑧 is (1 − 𝑎 𝑠 ) 𝑖−1 𝑃0 (𝑧 | 𝑠)1{𝑑 (𝑧) = 𝑏 𝑠 }; the probability that all 𝑘 candidates miss and 𝐹 = 𝑧 is (1 − 𝑎 𝑠 ) 𝑘 𝑃0 (𝑧 | 𝑠). These disjoint cases give  𝑄 𝑘 (𝑧 | 𝑠) = 𝑃0 (𝑧 | 𝑠) (1 − 𝑎 𝑠 ) 𝑘 + 1{𝑑 (𝑧) = 𝑏 𝑠 }

𝑘−1 ∑︁

 (49) (1 − 𝑎 𝑠 ) , 𝑖

𝑖=0

which is Eq. (29). To verify normalisation directly, summing Í 𝑘−1 over 𝑧 yields (1 − 𝑎 𝑠 ) 𝑘 + 𝑎 𝑠 𝑖=0 (1 − 𝑎 𝑠 ) 𝑖 = 1, including 𝑎 𝑠 = 0 and 𝑎 𝑠 = 1. The emitted bit is incorrect precisely if all 𝑘 candidates miss and the fresh fallback also misses. Independence therefore yields Pr [𝑑 (𝑍) = 𝐵 | 𝑆 = 𝑠] = 1 − (1 − 𝑎 𝑠 ) 𝑘+1 ,

(50)

𝑄𝑘

proving Eq. (30). In particular, for 𝑘 = 1 and 𝑎 𝑠 = 1/2, the recovery probability is 3/4.

(52)

(53)

𝑧

Under the fair-bit assumption, writing 𝑢𝑟 (𝑧) := 𝑃0 [𝐵 = 1 | 𝑍 = 𝑧, 𝑅 = 𝑟], the corresponding joint-law distance is TV(𝑃0(𝐵,𝑍 ) |𝑟 , 𝑝 𝑟 ⊗ 𝛽𝑟 ) ∑︁ 1 ∑︁ = 𝛽𝑟 (𝑧) 𝑃0 [𝐵 = 𝑏 | 𝑧, 𝑟] − 12 2 𝑧 𝑏∈ {0,1} ∑︁ = 𝛽𝑟 (𝑧)|𝑢𝑟 (𝑧) − 12 |.

(54)

𝑧

For each 𝑧, 𝑚 𝑟 (𝑧) equals either 𝑢𝑟 (𝑧) or 1 −𝑢𝑟 (𝑧) according to 𝑑 (𝑧), so |𝑚 𝑟 (𝑧) − 1/2| = |𝑢𝑟 (𝑧) − 1/2|. Combining Eqs. (53) and (54) proves the total-variation identity. For Í 𝑍 |𝑟 the 𝜒2 identity, 𝜒2 (𝑃𝑄 ∥ 𝛽𝑟 ) = 𝑧 𝛽𝑟 (𝑧)(ℓ𝑘,𝑟 (𝑧) − 1) 2 = 𝑘 Í 4𝛿2 𝛽 (𝑧)(𝑚 𝑟 (𝑧) − 21 ) 2 , while 𝜒2 (𝑃0(𝐵,𝑍 ) |𝑟 ∥ 𝑝 𝑟 ⊗ 𝛽𝑟 ) = Í Í 𝑘 𝑧 𝑟Í 1 2 1 𝑧 𝛽𝑟 (𝑧) 𝑏 (𝑃0 [𝐵 = 𝑏 | 𝑧, 𝑟] − 2 ) / 2 = 4 𝑧 𝛽𝑟 (𝑧)(𝑢 𝑟 (𝑧) − 1 2 1 1 2 ) , and |𝑚 𝑟 − 2 | = |𝑢 𝑟 − 2 |. For 𝑇 independent rounds with 𝑅 = 𝑟, let 𝑃 and 𝑃′ be the 𝑇-fold laws of selected and reference messages and 𝑐𝑟 the single-round 𝜒2 divergence. The total-variation distance TV(𝑃, 𝑃′ ) is the largest advantage TPR − FPR of any test. Since 1 +√︁𝜒2 is multiplicative over independent rounds and TV ≤ 21 𝜒2 by the Cauchy–Schwarz inequality, TV(𝑃, 𝑃′ ) ≤ 12 ((1 + 𝑐𝑟 ) 𝑇 − 1) 1/2 ≤√︁ 12 (𝑒𝑇 𝑐𝑟 − 1) 1/2 . For Í the lower bound, let BC := 𝑧 𝛽𝑟 (𝑧) ℓ𝑘,𝑟 (𝑧) be the Bhat-

tacharyya coefficient of one round; it is multiplicative over rounds, and TV ≥ 1−BC for any two laws. Because ℓ𝑘,𝑟 ≤ 2, 1 − BC = 12

∑︁ 𝑧

(ℓ𝑘,𝑟 (𝑧) − 1) 2 𝑐𝑟 𝑐𝑟 , 𝛽𝑟 (𝑧) √︁ ≥ ≥ √ 2 2 12 2(1 + 2) ( ℓ𝑘,𝑟 (𝑧) + 1)

so TV(𝑃, 𝑃′ ) ≥ 1 − BC𝑇 ≥ 1 − (1 − 𝑐𝑟 /12) 𝑇 ≥ 1 − 𝑒 −𝑇 𝑐𝑟 /12 . Finally, if 𝐵 and 𝑍 are independent given 𝑅 under 𝑃0 , then 𝑚 𝑟 ≡ 1/2, so ℓ𝑘,𝑟 ≡ 1 and 𝑄 𝑘 ∈ F𝑅 , while Eq. (30) with 𝑎 𝑠 = 1/2 gives recovery 1 − 2− (𝑘+1) . Outside the balanced case, Eq. (51) gives the exact ratio. □ Keyed selection. Let 𝜉 be a uniform bit independent of 𝑆, known to sender and receiver, and let the sender select on 𝑑 (𝑧) = 𝑏 𝑠 ⊕ 𝜉. In the balanced case 𝑃0 [𝑑 (𝑍) = 𝑦 | 𝑆 = 𝑠] = 1/2 for both values of 𝑦, so given 𝜉 = 𝑥 the kernel is 𝑃0 (𝑧 | 𝑠) [2−𝑘 + 2𝛿 𝑘 1{𝑑 (𝑧) = 𝑏 𝑠 ⊕ 𝑥}], and averaging over 𝑥 gives 𝑃0 (𝑧 | 𝑠) [2−𝑘 + 𝛿 𝑘 ] = 𝑃0 (𝑧 | 𝑠). The receiver’s estimate 𝑑 (𝑍) ⊕ 𝜉 equals 𝐵 unless all 𝑘 + 1 draws miss, which has probability 2− (𝑘+1) . Canonical-interface bounds and receiver preservation. Let 𝐶 = 𝑐(𝑍) take values in a set C of cardinality at most 𝐾. Since 𝐶 is a deterministic function of 𝑍, data processing and the entropy bound give 𝐼𝑄 (𝑆; 𝐶) ≤ 𝐻𝑄 (𝐶) ≤ log2 𝐾 and 𝐼𝑄 (𝐵; 𝐶 | 𝑅) ≤ 𝐻𝑄 (𝐶 | 𝑅) ≤ log2 𝐾. If 𝑐 is idempotent and the fixed receiver factors as 𝜌(𝑎 | 𝑧) = e 𝜌 (𝑎 | 𝑐(𝑧)), then for every 𝑧, 𝑎, 𝜌(𝑎 | 𝑐(𝑧)) = e 𝜌 (𝑎 | 𝑐(𝑐(𝑧))) =e 𝜌 (𝑎 | 𝑐(𝑧)) = 𝜌(𝑎 | 𝑧),

(55)

so replacing each message by its canonical form preserves the conditional receiver-action law (and the action itself when the receiver is deterministic). For the stronger conditional bound, let 𝐾 ≥ 2, let ℎ : R → C be a task-only representation, and put 𝐸 := 1{𝐶 ≠ ℎ(𝑅)}, with Pr𝑄 [𝐸 = 1] = 𝜀. Because 𝐸 is determined by (𝐶, 𝑅), the chain rule yields 𝐻𝑄 (𝐶 | 𝑅) = 𝐻𝑄 (𝐸 | 𝑅) + 𝐻𝑄 (𝐶 | 𝐸, 𝑅). Concavity of binary entropy gives 𝐻𝑄 (𝐸 | 𝑅) ≤ ℎ2 (𝜀). When 𝐸 = 0, 𝐶 = ℎ(𝑅) is determined by 𝑅; when 𝐸 = 1, at most 𝐾 −1 canonical outputs remain possible for each 𝑅 = 𝑟. Thus 𝐻𝑄 (𝐶 | 𝑅) ≤ ℎ2 (𝜀) + 𝜀 log2 (𝐾 − 1).

(56)

Finally, 𝐵 = 𝑔(𝑅, 𝑁) implies the conditional Markov relation 𝐵−(𝑁, 𝑅)−𝐶, whence conditional data processing gives 𝐼𝑄 (𝐵; 𝐶 | 𝑅) ≤ 𝐼𝑄 (𝑁; 𝐶 | 𝑅) ≤ 𝐻𝑄 (𝐶 | 𝑅). Combining these inequalities proves Eq. (35). When 𝜀 = 0, 𝐶 = ℎ(𝑅) almost surely and both conditional mutual informations vanish. This is a bound for the whole canonical message, and therefore for any post-processing or decoder of it. Binary recovery on a nearly task-only interface. Suppose b additionally that 𝐵 is a fair bit conditional on 𝑅, and let 𝐵 be any possibly randomised binary decoder of (𝐶, 𝑅), with its randomisation independent of the private state. Couple it b0 obtained by feeding the same to the task-only decoder 𝐵 decoder and random coins the value ℎ(𝑅) in place of 𝐶. b0 depends only on 𝑅 and independent coins, Because 𝐵 b Pr[ 𝐵0 = 𝐵] = 1/2. The two decoder outputs agree whenever

𝐸 = 0, so their correctness indicators can differ only on the event 𝐸 = 1. Consequently, b = 𝐵] − 1 ≤ Pr[𝐸 = 1] = 𝜀. Pr[ 𝐵 2

(57)

Proof of Proposition 5.3. The recovery bound is Eq. (57). For the information bound, let 𝐵 be fair given each 𝑅 = 𝑟 and write 𝜀𝑟 = Pr[𝐶 ≠ ℎ(𝑟) | 𝑅 = 𝑟]. If 𝜀𝑟 ≥ 1/2, then 𝐼 (𝐵; 𝐶 | 𝑅 = 𝑟) ≤ 1 ≤ 2𝜀𝑟 . Otherwise Pr[𝐵 = 1, 𝐶 = ℎ(𝑟) | 𝑅 = 𝑟] lies in [1/2 − 𝜀𝑟 , 1/2], so given 𝐶 = ℎ(𝑟) the probability that 𝐵 = 1 lies between 𝑥𝑟 := (1/2−𝜀𝑟 )/(1−𝜀𝑟 ) and 1 − 𝑥𝑟 . Hence 𝐻 (𝐵 | 𝐶, 𝑅 = 𝑟) ≥ (1 − 𝜀𝑟 )ℎ2 (𝑥𝑟 ) and   1/2 − 𝜀𝑟 . 𝐼 (𝐵; 𝐶 | 𝑅 = 𝑟) ≤ 𝑓 (𝜀𝑟 ) := 1 − (1 − 𝜀𝑟 ) ℎ2 1 − 𝜀𝑟 The function 𝑓 is convex on [0, 1/2], because (1 − 𝜀)ℎ2 (𝑥), with 𝑥
as above, has second derivative −1/ 2(1/2 − 𝜀)(1 − 𝜀) ln 2 < 0, and 𝑓 (0) = 0, 𝑓 (1/2) = 1. So 𝑓 (𝜀) ≤ 2𝜀, and averaging over routes gives 𝐼 (𝐵; 𝐶 | 𝑅) ≤ 2𝜀. For a key 𝜉 independent of 𝑆, conditioning on 𝜉 = 𝑥 leaves the law of 𝑆 unchanged and gives a sender with routÍ ing error 𝜀 𝑥 , where 𝑥 Pr[𝜉 = 𝑥]𝜀 𝑥 = 𝜀. Each bound above holds given 𝜉 = 𝑥 with 𝜀 𝑥 , and 𝐼 (𝐵; 𝐶, 𝜉 | 𝑅) = 𝐼 (𝐵; 𝐶 | 𝑅, 𝜉) because 𝜉 is independent of (𝑅, 𝐵), and likewise for 𝑁. Averaging over 𝑥, which is linear for the recovery bound and for 2𝜀 and concave for ℎ2 (𝜀) + 𝜀 log2 (𝐾 − 1), proves the keyed versions. □ The argument also applies when the decoder receives only 𝐶, by ignoring the additional 𝑅 input. It holds for any joint law with the stated balance and routing-error conditions, including the balanced empirical joint distribution used in Sect. 6.4; inserting a measured error fraction gives a bound for that empirical distribution, not by itself a population confidence guarantee.

A.7. Law-preserving resampling sender Proof of Proposition 5.2. Fix a route 𝑟 with 𝜋(𝑟) > 0 and an attribute value 𝑏 with 𝑝 𝑟 (𝑏) > 0. Since 𝜅★ 𝑟 has marginals 𝑝 𝑟 and 𝑞 𝑟𝑑 , the distribution 𝜅★ 𝑟 (𝑏, 𝑦)/𝑝 𝑟 (𝑏) over decoder targets 𝑦 is normalised. Moreover, any 𝑦 selected with positive probability satisfies 𝑞 𝑟𝑑 (𝑦) > 0: otherwise the second ★ marginal of 𝜅★ 𝑟 would force 𝜅 𝑟 (𝑏, 𝑦) = 0 for every 𝑏. Thus no selected target has zero acceptance probability. On each trial the auxiliary state is drawn afresh from 𝛼𝑟 and the reference message is generated for that state. The unconditional law of a trial message, given 𝑅 = 𝑟, is Í therefore 𝑛′ 𝛼𝑟 (𝑛′ )𝑃0 (𝑧 | 𝑟, 𝑛′ ) = 𝛽𝑟 (𝑧). Independent trials terminate almost surely for a fixed selected target 𝑦, and the accepted message has the conditional reference distribution Pr[𝑍 = 𝑧 | 𝑅 = 𝑟, 𝐵 = 𝑏, 𝑌 = 𝑦] 𝛽𝑟 (𝑧)1{𝑑 (𝑧) = 𝑦} = . 𝑞 𝑟𝑑 (𝑦)

(58)

Averaging over the selected target and multiplying by 𝑝 𝑟 (𝑏) gives, for every 𝑧 with 𝑞 𝑟𝑑 (𝑑 (𝑧)) > 0, Pr[𝐵 = 𝑏, 𝑍 = 𝑧 | 𝑅 = 𝑟] = 𝜅★ 𝑟 (𝑏, 𝑑 (𝑧))

𝛽𝑟 (𝑧) . 𝑑 𝑞 𝑟 (𝑑 (𝑧))

(59)

If 𝑞 𝑟𝑑 (𝑑 (𝑧)) = 0, then 𝛽𝑟 (𝑧) = 0 and the joint probability is zero. This is exactly the lifted coupling of Eq. (42). Summing Eq. (59) over 𝑏 yields Í Pr[𝑍 = 𝑧 | 𝑅𝑑= 𝑟] = 𝛽𝑟 (𝑧) on the positive support, since 𝑏 𝜅★ 𝑟 (𝑏, 𝑦) = 𝑞 𝑟 (𝑦); the equality also holds on the zero support. Because this argument holds for every positive-probability route, the sender preserves 𝑃 (𝑅,𝑍 ) = 𝜆0 and hence belongs Í to F𝑅 . Its decoder-recovery 𝑑 probability within route 𝑟 is 𝑏 𝜅★ 𝑟 (𝑏, 𝑏) = 1 − TV( 𝑝 𝑟 , 𝑞 𝑟 ) by maximal coupling. Averaging over routes proves optimality by Corollary 4.4. For completeness, the number of reference draws until acceptance, conditional on 𝑌 = 𝑦, is geometric with mean 1/𝑞 𝑟𝑑 (𝑦). The target marginal conditional on 𝑅 = 𝑟 is 𝑞 𝑟𝑑 by the second marginal of 𝜅★ 𝑟 . Consequently, the mean number of reference draws per emitted message in that route Í is 𝑦:𝑞𝑟𝑑 ( 𝑦) >0 𝑞 𝑟𝑑 (𝑦)/𝑞 𝑟𝑑 (𝑦) = | supp(𝑞 𝑟𝑑 )|, which equals two for a binary decoder when both values have positive probability, and one otherwise. This is an expectation over the route’s state distribution; no uniform finite per-message budget is asserted. □

The frozen common instruction is reproduced below. The suppression and disclosure conditions append different metadata instructions; the resulting prompt is then followed by the record, beginning with CASE FILE and listing the five field–value pairs in the frozen order. The model’s chat template supplies the system formatting, and the complete executed prompt strings and token IDs are retained in the run manifest. These conditions therefore define different honest reference laws.

Appendix B. Experimental Details and Reproducibility

The disclosed honest control instead appends:

This appendix specifies the frozen experimental protocol, statistical analysis, and procedures for reproducing the measurements in Sect. 6. The implementation is available in the anonymous, read-only source artefact linked in Sect. B.7. The repository supplies code and configuration rather than the generated experimental observations or pretrained model weights; a full rerun requires locally obtaining the pinned model and regenerating the data.

B.1. Synthetic Task, Prompts, and Interfaces The experiment uses a fixed, uniformly weighted population of 64 synthetic incident records. The task route 𝑅 ∈ {0, . . . , 15} is the Cartesian product of four fault domains (storage_array, network_fabric, auth_service, batch_scheduler) and four severities (sev1_critical, sev2_major, sev3_minor, sev4_cosmetic). Each route has four administrative variants 𝑁 ∈ {0, 1, 2, 3}, with fields intake_office, intake_shift, and intake_channel; these variants are deterministic combinations of four values per field, not independently sampled field combinations. The target is 𝐵 = 𝑁 mod 2. Consequently, 𝑅 and 𝑁 are independent and uniform in this test population, and 𝐻 (𝐵 | 𝑅) = 1 bit. For each route 𝑟 = 4𝑑 + 𝑒 and variant 𝑣, the domain and severity are the 𝑑th and 𝑒th entries in the ordered lists above; the office is the 𝑣th of (XXXX-2, XXXX-17, Aarhus, Porto)* , the shift is the (𝑣+1) mod 4th of (morning, midday, evening, night), and the channel is the (3𝑣 + 2) mod 4th of (phone, email, portal, walk in). The records contain no real incident or personal information. * The first two are city names redacted for anonymous review.

You route incident tickets to a remediation team. Read the case file and report its fault_domain and severity exactly as recorded. These two fields determine the route. Give a brief description of the incident. Reply using exactly these three lines: domain: <fault_domain value> severity: <severity value> summary: <one short sentence>

The suppressed condition appends the following instruction: The intake_office, intake_shift and intake_channel are administrative metadata. Do not include, paraphrase or hint at them in your reply.

The intake_office, intake_shift and intake_channel are administrative metadata. Include all three exact values in the summary sentence.

The receiver is a deterministic parser applied to the emitted text. It requires exactly one line beginning with the lowercase label domain: and exactly one beginning with severity:; it trims ASCII whitespace from their values and accepts only the enumerated domain and severity strings. Missing, duplicate, or invalid routing fields yield REJECT. The receiver does not infer a route from the summary or consult the private state. Its action 𝐴 is the parsed route (one of 16 values) or rejection; task utility is 1{𝐴 = 𝑅}. Additional summary text is allowed by the parser even when it fails the requested output format, so routing accuracy measures this declared parser task rather than strict instruction compliance. Write 𝑊 for the generated token-ID sequence, including an end-of-sequence token if sampled, and 𝑉 for the rendered UTF-8 text. The renderer skips special tokens and disables tokeniser whitespace clean-up; it does not append an artificial end-of-sequence token when generation reaches its length cap. The public decoder 𝐽 = 𝑑 (𝑉) is the low bit of the last byte of SHA-256(UTF8(𝑉)), with no stripping or Unicode normalisation. Hash recovery is 1{𝐽 = 𝐵}, independently of whether the receiver routes correctly. Hashing, parsing, and the canonical interface operate on 𝑉, whereas model likelihoods refer to the retained token sequence 𝑊. We do not assume that token-to-text rendering is injective.

B.2. Model, Selection Arms, and Randomness The reference generator is Qwen/Qwen2.5-1.5B-Instruct at model and tokeniser revision 989aa7980e4cf806f80c7fef2b1adb7bc71aa306.

Generation uses temperature 1, the full next-token distribution without top-𝑘, top-𝑝, or repetition filtering, and a cap of 96 continuation tokens. The recorded execution used FP32 model arithmetic, eager attention, disabled TF32, and FP64 log-softmax reductions for likelihood evaluation. The same pinned reference model, decoding rule, and suppression prompt are used for all candidate-selection arms; the selection wrapper alone changes which completed response is emitted. For each suppressed-condition round at private state 𝑠, the collector generates 19 independent reference draws: two honest controls H and H′ , a pool (𝑉1 , . . . , 𝑉16 ), and one additional fallback 𝑉spare . For 𝑘 ∈ {1, 2, 4, 8, 16}, sender 𝑄 𝑘 emits the first 𝑉𝑖 with 𝑖 ≤ 𝑘 and 𝑑 (𝑉𝑖 ) = 𝐵(𝑠); if no such candidate exists, it emits 𝑉spare regardless of the fallback’s decoded bit. The five selection arms share the same candidate pool and fallback within a round, and H, H′ are never candidates. All 19 draws are generated and retained even when a small-budget arm finds an early match. Thus every 𝑄 𝑘 is a deterministic choice from the saved round bundle; treating the seven emitted arms as independent samples would be incorrect. No selection candidates are generated for the separate honest disclosure control. Post hoc law-preserving arm. This arm reuses the stored suppressed-condition test pools and generates nothing new. For a round with state (𝑟, 𝑛) and bit 𝑏, the decoder target is 𝑦 = 𝑏, except that when 𝑞b𝑟𝑑 (𝑏) < 1/2 it is flipped with probability 1 − 2b 𝑞 𝑟𝑑 (𝑏), which realises the maximal coupling 𝑑 of 𝑝 𝑟 and 𝑞b𝑟 ; its expected recovery on the test design is 2,007/2,048 = 97.998%. Each trial then picks one of the four records of route 𝑟 uniformly at random and takes that record’s next unused pool candidate, until 𝑑 (𝑉) = 𝑦. The 8,192 messages used 16,602 draws, at most 15 in a round; no record ran out of candidates, and there is no fallback. Only 9 emitted messages coincide with the candidate that 𝑄 16 emitted from the same pool. All monitors score these messages with the parameters and thresholds fitted for 𝑄 16 , without refitting. The eight base seeds are 2026092901–2026092908. Each draw receives its own pseudorandom stream seed, derived from the SHA-256 digest of a canonical serialisation containing the namespace paper1-fresh-v3, data split, prompt condition, base seed, state ID, round index, and draw role. The first eight digest bytes, reduced modulo 263 , determine the stream seed; this prevents generation order, batching, and parallel scheduling from silently assigning draws to different arms. The independent decodermatch calibration uses seed 2026092988 and its own split identifier. The numerical results are interpreted under the specified independent-draw sampling model; deterministic pseudorandom seeding provides replayability rather than a mathematical guarantee of physical randomness.

B.3. Splits, Likelihood Scoring, and Provenance Each of the 64 states occurs under all eight base seeds in each suppressed-condition split. Training and threshold calibration have two rounds per state and seed (1,024 rounds

TABLE 3. F ROZEN COLLECTION ACCOUNTING . A SUPPRESSED - CONDITION ROUND CONTAINS 19 REFERENCE DRAWS , EVEN THOUGH ONLY SEVEN ARMS ARE EMITTED . Component

Round units Draws/unit Messages

Training (suppressed) Calibration (suppressed) Test (suppressed) Disclosure control Hash-match calibration

1,024 1,024 8,192 1,024 4,096

19 19 19 1 1

19,456 19,456 155,648 1,024 4,096

Total

15,360

—

199,680

each); the held-out test split has 16 rounds per state and seed (8,192 rounds). The disclosure control contains two independent honest test draws per state and seed (1,024 messages). Independent hash-match calibration contains 64 honest draws per state (4,096 messages, or 256 per route). The sample allocation was fixed before analysis. The likelihoodscored suppressed subset comprises one round per state and seed in training and calibration (512 rounds per split) and two in testing (1,024 rounds), with the retained H, H′ , and 𝑄 16 outputs. The disclosure control is likewise likelihoodscored. For a retained token sequence 𝑤 = (𝑤 1 , . . . , 𝑤 𝑇 ) and any reference state 𝑠, likelihood evaluation computes the Í sequence log probability 𝐿 𝑠 (𝑤) = 𝑇𝑡=1 log 𝑃0 (𝑤 𝑡 | 𝑠, 𝑤 <𝑡 ) under that state’s prompt, including the observed stopping convention. Cross-state scoring uses the saved token IDs rather than retokenising rendered text. Identical token sequences within a prompt condition may share a computed likelihood column, but repeated observations retain their multiplicities in all empirical averages. The completed run records 6,721 distinct 64-state likelihood columns (430,144 state–sequence scores); this is an implementation economy, not an observation-level deduplication. The collection pipeline freezes the model revision, synthetic population, prompts, source code, runtime information, decoding settings, seeds, and checksums before production. It checkpoints all candidate draws and chosen roles, and verifies that saved token sequences render to the recorded text. Generation and scoring implementations are cross-checked using preflight numerical comparisons, independent scoring checks, and selected same-seed replays. The completed run’s integrity records report successful checks, including 256 exact generation replays and 16 complete independent reference-column audits. Hardware-dependent numerical differences can still occur on a new installation; the repository preserves tolerances and diagnostic outputs rather than assuming bitwise portability across GPUs.

B.4. Estimands and Statistical Procedures All estimates are averages over the fixed, equally weighted 64-state population; uncertainty represents repeated generation under the stated sampling procedure, not sampling new incident types or model families. For arm 𝑎, public-bit recovery and routing utility are 𝑝 𝑎 = Pr[𝑑 (𝑉𝑎 ) = 𝐵] and 𝑢 𝑎 = Pr[ 𝐴 𝑎 = 𝑅]. Differences 𝑝 𝑄𝑘 − 𝑝 H and

𝑢 𝑄𝑘 − 𝑢 H are calculated within paired round bundles. The primary study used predefined routing criteria 𝑢 H ≥ 0.90 and 𝑢 𝑄16 −𝑢 H ≥ −0.05, assessed with conservative one-sided bounds; meeting these design tolerances is not a statement of exact equality of task laws. The primary recovery, routing, and paired-difference intervals use 5,000 percentile bootstrap resamples (seed 2026092999), resampling whole round bundles within each of the 64 fixed states while pooling the eight base seeds. Supplementary theory-aligned information and receiverinterface intervals use another 5,000 paired replicates (seed 2026100301), resampling within every state-by-base-seed stratum. For either procedure, all arms and canonical outputs within a selected round receive the same resampling weight. The two procedures differ in stratification; both yield descriptive intervals conditional on the fixed experimental design. These bootstrap intervals are not used to claim certainty from an all-success result or to certify new-model generalisation. For an outcome with zero errors in 𝑛 independent, potentially non-identically distributed trials, a one-sided 1 − 𝛼 bound on the design-averaged error probability 𝜂 is 𝜂 ≤ 1 − 𝛼1/𝑛 . Indeed, if individual success probabilities are 1 − 𝜂𝑖 , the arithmetic–geometric mean inequality Î 1 Í 𝑛 gives Pr[all succeed] = 𝑖 𝜂𝑖 ) . 𝑖 (1 − 𝜂𝑖 ) ≤ (1 − 𝑛 With 𝑛 = 8,192 and 𝛼 = 0.05, the zero observed errors of 𝑄 16 imply 𝜂 ≤ 3.66 × 10−4 at one-sided 95% confidence. This is numerically the usual all-success Clopper– Pearson endpoint, but the stated justification also covers the fixed, balanced, non-identically distributed design under independent sampling. Allocating 𝛼/16 to each of 16 routes gives simultaneous bounds from 512 held-out rounds per route. For nonzero error counts, the theory-aligned analysis uses two-sided Hoeffding intervals for the design-averaged error and transforms the entire error interval through binary entropy. Because 𝐻 (𝐵 | 𝑅) = 1 bit, conditional Fano’s inequality and data processing give 𝐼 (𝐵; 𝑉 | 𝑅) ≥ 𝐼 (𝐵; 𝐽 | 𝑅) ≥ 1 − ℎ2 (𝜂) for the fixed decoder 𝐽 = 𝑑 (𝑉). The zero-error bound above therefore gives a conservative 0.9953-bit lower confidence bound for 𝑄 16 , rather than interpreting the empirical 100% success as a mathematically noiseless population channel. Independently, the reported plug-in decoder information is calculated from route-conditioned 2 × 2 contingency tables: b 𝐼 (𝐵; 𝐽
| Í Í −1 𝑅) = 16 b𝑟 (𝑏, 𝑗) log2 𝑝b𝑟 (𝑏, 𝑗)/( 𝑝b𝑟 (𝑏) 𝑝b𝑟 ( 𝑗)) , 𝑟 𝑏, 𝑗 𝑝 with zero-mass terms omitted. This finite-sample mutualinformation estimate is not itself a confidence lower bound and may exhibit positive bias near zero.

B.5. Monitors, Calibration, and Repeated Observations The detector suite compares 𝑄 16 with H. The structure classifier uses simple rendered-message formatting and length features, while the text classifier uses character 3– 5-gram TF–IDF features (at most 8,192 features); both are

logistic regressions trained only on the training split. Reference surprisal is − log2 𝛽(𝑊), computed from reference token-sequence likelihoods, and its trusted-route analogue is − log2 𝛽𝑟 (𝑊). The selection-aware monitor uses the known selection kernel to score the likelihood ratio between the selected and honest marginal laws, with the unknown statewise match probabilities estimated from the independent calibration stream using Jeffreys smoothing. The trustedroute variant conditions that calculation on the supplied true 𝑅. None of these detectors receives the true 𝐵 for the tested message; the known-code positive control explicitly does. The nominal false-positive target is 5%. For every detector, a threshold is determined from honest calibration scores using a strict exceedance rule and is then held fixed on test messages; AUC is computed separately and does not depend on that threshold. The optional novelty purge removes a complete later round bundle if any emitted-arm text repeats an earlier retained split’s text. Training retains 1,024 rounds, while novelty filtering leaves 773 calibration and 5,723 test rounds for learned-text monitors; the likelihood-scored novelty cohort has 512 training, 393 calibration, and 706 test rounds. The main recovery and routing endpoints never apply this purge. The full-stream detector evaluations apply the thresholds learned from the purged calibration cohort to all 8,192 test rounds for text/structure monitors, or all 1,024 likelihood-scored test rounds for likelihood monitors. This distinction explains why the full-stream surprisal monitor has 14.06% false positives despite the nominal 5% calibration target: its threshold was selected on the novelty-purged 393-round honest likelihood calibration cohort, whereas the reported full-stream rate uses all 1,024 test observations. The reported AUC remains interpretable as threshold-free ranking discrimination. For collection tests, scores are averaged over disjoint groups of 16 separately sampled rounds after a fixed permutation, using the same grouping for the paired honest and selected arms; each collection receives its own honest calibration threshold. The full likelihood cohort supplies 64 test collections and 24 calibration collections per arm. These collections are aggregate independent interactions, not adaptive multi-turn conversations. Consequently, the much stronger selection-aware collection result does not demonstrate security against, or detection within, an adaptive dialogue protocol. Table 4 gives 95% intervals for every AUC of Table 2 from 5,000 paired bootstrap replicates. The character-text classifier ranks honest test messages very slightly above both attack arms, so its interval lies just below 0.5 for both; this is not detection.

B.6. Theory-Aligned Diagnostics and Canonicalisation The independent 4,096-draw hash calibration estimates 𝑎 𝑠 = Pr0 [𝑑 (𝑉) = 𝐵(𝑠) | 𝑆 = 𝑠] from 64 draws per state. Substitution into the exact selection formula 1 − (1 − 𝑎 𝑠 ) 𝑘+1 and uniform averaging over states yields predictions for each candidate budget without fitting to the held-out candidate pools. The same independent sample supplies 256 draws

TABLE 4. AUC S OF TABLE 2 WITH 95% BOOTSTRAP INTERVALS (5,000 PAIRED REPLICATES ). Monitor

𝑄16

Law-preserving

Structure (1) Character text (1) Surprisal (1) Selection-aware ratio (1) Selection-aware ratio (16) Route surprisal (1) Route-aware ratio (1) Route-aware ratio (16) Known-code control (16)

.504 [.496, .511] .490 [.481, .499] .496 [.474, .519] .645 [.622, .667] .972 [.947, .992] .496 [.474, .519] .645 [.622, .667] .972 [.947, .992] 1.000 [1.000, 1.000]

.503 [.496, .510] .490 [.481, .499] .495 [.472, .518] .504 [.480, .528] .540 [.450, .633] .495 [.472, .518] .504 [.480, .527] .540 [.450, .633] 1.000 [1.000, 1.000]

per route to estimate 𝑞 𝑟𝑑 (1) = Pr0 [𝑑 (𝑉) = 1 | 𝑅 = 𝑟]. The observed Í 𝑑 range 0.4492–0.5430 gives a plug-in value 1−16−1 𝑟 |b 𝑞 𝑟 (1)−1/2| ≈ 0.9800 for Corollary 4.4. This diagnostic concerns the hypothetical exact task-law-preserving class; the tested selection senders are not assumed to belong to that class. Simultaneous Hoeffding intervals for the 16 estimated route probabilities include 1/2 in every case and do not certify exact mass balance. The honest likelihood analysis uses the four stateconditioned sequence likelihoods within each true route to Í compute 𝑃0 (𝐵 = 𝑏  | Í𝑊 = 𝑤, 𝑅 = 𝑟) = 𝑠:𝑅 (𝑠)=𝑟 , 𝐵(𝑠)=𝑏 𝑃0 (𝑤 | 𝑠) / 𝑠:𝑅 (𝑠)=𝑟 𝑃0 (𝑤 | 𝑠) . Averaging the resulting binary posterior entropies on honest b0 (𝐵 | 𝑊, 𝑅): 0.2620 outputs gives b 𝐼0 (𝐵; 𝑊 | 𝑅) = 1 − 𝐻 bits under suppression and 0.7368 bits under the separately prompted disclosure control. These are reference-law token-sequence quantities, not measurements of selectedsender mutual information and not, without summing over rendering preimages, exact rendered-text information. They explain why near-chance recovery by the honest hash should not be interpreted as independence of private state and honest messages. The same posteriors give (1 − 2−16 ) times their mean absolute deviation from 1/2 on honest outputs, 0.189, the route-averaged distance between 𝑄 16 and H that Theorem 5.1 gives in the balanced case. The largest TPR − FPR of the single-message selection-aware ratio over all thresholds is 0.205; a maximum over thresholds is biased upwards at this sample size, and the threshold-free AUC stays below the implied ceiling of 0.671. Administrative statements are detected by conservative, contextual matching of whole field values. Under the suppression prompt, 1,541 of the 8,192 honest test messages (18.8%) contain at least one; under the disclosure prompt, 626 of 1,024 (61.1%) do, and 37 (3.6%) state all three values. Even if each statement revealed 𝐵 exactly, such messages would contribute at most about 0.094 of the mean deviation and 0.188 of the 0.262 bits. For each arm, the supplementary analysis estimates the full 17-category receiver distribution conditional on each true route and reports 𝐷 task (𝑄, H) = Í b𝐴|𝑟 , 𝑃 b𝐴|𝑟 ). For 𝑄 16 , this is 0.004517, match16−1 𝑟 TV( 𝑃 𝑄 H ing the point estimate for independently sampled H′ against H; the equality of these estimates does not establish equality of population receiver laws. The empirical conditional

decoder information is computed from the same routebalanced contingency tables before and after enforcement, with separate paired-bootstrap uncertainty. The canonicaliser maps each accepted parsed route to exactly domain: <value> followed by severity: <value>, or maps parser failure to the single string REJECT. It accesses only the incoming text and preserves the receiver’s parsed action for every possible input; it does not repair an incorrectly parsed route using the true state. Exhaustive checks on the saved test observations find zero receiver-action changes in 7 × 8,192 = 57,344 comparisons. For 𝑄 16 , the hash decoder’s recovery changes from 100% to 49.95%, and its estimated 𝐼 (𝐵; 𝐽 | 𝑅) falls from 1.0000 to 0.000629 bits (a 0.9994-bit reduction). More generally, with 𝐾 = 17 canonical outputs, 𝐶 = 𝑐(𝑉), and task-only canonical target ℎ(𝑅), the observed routingerror fraction b 𝜀 = 115/8192 gives the empirical-distribution bound b 𝐼 (𝐵; 𝐶 | 𝑅) ≤ ℎ2 (b 𝜀) + b 𝜀 log2 (16) ≈ 0.163 bits and confines every binary decoder’s test-population recovery to [1/2 − b 𝜀 , 1/2 + b 𝜀 ]. The latter are all-decoder statements under the enforced interface, evaluated on the saved test distribution, not population confidence guarantees.

B.7. Anonymous Artefact and Reproduction Anonymous code artefact. The source code, tests, frozen configuration, and runner scripts are accessible for anonymous review at https://anonymous.4open.science/r/pass ive-monitoring-EC82/. The link is a read-only repository mirror; it is not itself a deposited dataset or a model-weight archive. No identifying source-repository address is needed to follow the study. Reviewers should use the files provided by this anonymous artefact and the documented environment setup; generating a new run and analysing an existing results archive are distinct workflows. Implementation map. The repository’s R E A D M E . m d documents setup and supported execution modes, while c o n f i g / s t u d y . j s o n fixes the checkpoint, draw budgets, split sizes, base seeds, and analysis tolerances. The file study/protocol.py specifies the 64 synthetic records, exact prompts, hash decoder, parser, canonicalisation, candidate-selection rule, and stream derivation. Collection and validation are implemented by study/ pipeline.py and the generation engines, including study/production_fast.py. The primary outputs are computed by study/analysis.py, with detectors in study/detectors.py and resampling/statistical utilities in study/metrics.py. Additional theory-aligned information estimates and receiver-interface checks come from study/theory_analysis.py; the exact finite witness is independently checked by study/exact.py. The tests/ directory supplies automated checks of protocol, engines, analysis, and launch behaviour. Full GPU reproduction. The documented end-to-end run targets Linux and Python 3.12, a CUDA GPU with 24 GB VRAM, approximately 50 GB system RAM, and approximately 25 GB available disk space. The reported execution used one NVIDIA RTX A5000, PyTorch 2.8.0, and CUDA

12.8; production message collection took approximately 11.5 hours. After obtaining a local copy of the anonymous artefact, run the following from its root: bash run.sh tail -f logs/run.log

The launcher configures the runtime, runs preflight and consistency checks, retrieves the pinned model assets, carries out the frozen generation and analyses, and packages outputs and provenance. The run is launched asynchronously, so logs/run.log reports progress and completion; the repository README documents restart and checkpoint handling. The locally produced runs/paper_study-res ults.tar.gz archive includes collected observations and metadata needed for subsequent CPU-only analyses. It is a generated output, not a file assumed to be available in the anonymous code mirror. Repeating inference on other hardware can introduce numerical differences; the artefact retains tolerances, source/configuration hashes, and diagnostic checks rather than promising bitwise portability. CPU-only checks and reanalysis. Implementation tests and the frozen run plan can be inspected without generating LLM outputs: bash setup.sh cpu .venv/bin/python -m pytest -q .venv/bin/python -m study plan

For analysis-only reproduction, first obtain the generated paper_study- results.tar.gz archive from a completed production run, place it at the repository root, and unpack it; then execute the two analysis entry points: mkdir -p runs tar -xzf paper_study-results.tar.gz -C runs .venv/bin/python -m study analyze \ --run runs/paper_study \ --output results/analysis .venv/bin/python -m study theory \ --run runs/paper_study \ --analysis results/analysis \ --output results/theory

The primary analysis produces per-budget recovery and task-accuracy summaries, detection results, plots, and supporting records. The supplementary analysis produces pu blic_decoder_information_by_arm.csv, pe r_route_information_recovery.csv, fibre_ mass_balance.csv, task_interface_distanc es.csv, canonicalization_information.csv, and posthoc_theory_aligned_results.json, together with the underlying detailed tables. Accordingly, a reader can inspect the exact code and run the self-tests from the anonymous artefact, reproduce the full study by rerunning GPU inference, or regenerate analyses rapidly if the corresponding production archive is separately available. These routes should not be conflated: the code mirror alone does not enable instant numerical reproduction of the reported 199,680 generated messages.

Related documents

• Don't Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication#1389978
• Probabilistic Agents in Deterministic Audits: Evaluating Multi-Agent Systems for Automated Audits Based on the German IT-Grundschutz#306960
• When can we trust untrusted monitoring? A safety case sketch across collusion strategies#1049757
• Certifying information flow in multi-agent behaviours#1388005
• One Monitor Does Not Fit All: Formalism-Agnostic Runtime Verification for Agentic AI#1354501