arXiv CSopen access

Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools

Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools Bardia Mohammadi∗ ∗

Lars Klein†

Akhil Arora‡

Laurent Bindschaedler∗

Max Planck Institute for Software Systems † EPFL ‡ Aarhus University [email protected], [email protected] [email protected], [email protected]

arXiv:2606.02483v1 [cs.CR] 1 Jun 2026

Abstract Tool-augmented language agents speculatively issue likely future tool calls to hide latency, but those calls leak inferred user intent to external services before the agent commits to the branch. Every external observer that received the call retains the disclosure after the agent abandons the branch. Timing is the issue, not authorization: no commit-time cleanup, read-only restriction, or access-control allow-list unsends what an observer already holds. We call these invocations ghost tool calls and propose Speculative Tool Privacy Contracts, a runtime abstraction that treats observation before commitment as a first-class effect, distinct from state mutation. We implement the contracts in a prototype runtime and evaluate twelve policies across three corpora. Speculative dispatch increases what an observer can infer about user intent; posthoc filters, read-only restrictions, and accesscontrol allow-lists leave that inference intact; only issue-time policies that change or suppress the speculative call’s argument or destination projection before dispatch reduce it.

1

Figure 1: Motivating trace: user-facing two-turn dialogue (left, what the user sees) and the runtime’s speculative tree of dispatched tool calls (right). Green branches feed the answer; red branches are abandoned ghost calls.

the receiving providers have already logged them. The chain also encodes an inference the user never stated: the agent guessed the user might be looking to leave, might be facing eviction, and might need a loan to cover it. Speculation can persist across turns. A speculative pre-fetch about registered letters, issued while answering turn one, becomes the basis for the user’s follow-up about mailing a tracked letter. The user’s transcript looks innocuous; the provider’s view contains a biography. The mismatch lives in the trace. A speculative agent dispatches more tool calls than it ultimately uses, including calls along hypothetical branches the agent later abandons. We call those abandoned externally observable invocations ghost tool calls: the runtime issued them, did not promote them to the committed plan, and cannot retract them. Each ghost call deposits observer-visible state (provider logs, caches, audit sinks) from which an external observer can recover agent-inferred intent: the topics, entities, destinations, and follow-up actions the runtime predicted the user might need. Standard unsafe-tool framing misses this temporal mismatch. The same external search makes sense once the user has explicitly asked for legal resources; the runtime that ran it speculatively did so before knowing which workflow the agent would

Introduction

Tool-augmented language agents act through external systems. They search the web, retrieve enterprise documents, inspect calendars, query CRMs, send messages, and call application APIs. Each call creates a privacy surface beyond the final answer: fact, timing, destination, and content of the call can reveal information about the user or organization. Speculative tool execution widens that surface. A user might ask, “What’s the penalty for breaking my lease early?” (Figure 1). A careful agent answers the question. A latency-optimized agent fans out a tree of speculative queries: a search for tenant law, which the agent eventually uses; a sideways search for free apartments; and a deeper chain through eviction law into a personal-loan-rates API. The final reply uses the tenant-law search. The free-apartment and loan-rate branches do not, but 1

select. Access control answers whether the agent may call a tool; speculative privacy asks whether the agent may reveal a tentative branch, destination, or argument before commitment. Speculative disclosure is distinct from parallel tool execution, where every call belongs to the selected plan. Speculation is attractive because synchronous tool loops are slow, and recent systems expand speculation at the tool boundary (Sui et al., 2026; Ye et al., 2026; Guan et al., 2026; Hooper et al., 2026; Nichols et al., 2025; Xia et al., 2026; Feng et al., 2026). Existing safety abstractions reason about state mutation (read/write, reversible/irreversible) or about which committed calls a policy allows; none models the observer state created by issuing a call before the agent commits to needing it. The issue-time principle follows: for externally observable tools, the runtime must decide privacy policy before a speculative call leaves the trusted boundary, since commit-time cleanup has no privacy semantics once an observer has recorded the call. We propose Speculative Tool Privacy Contracts to enforce this principle. A contract labels a proposed event by execution mode, observer, sensitivity, destination, confidence, and audit policy. Before external dispatch, the monitor decides whether the call issues unchanged, transforms, routes to a trusted local substitute, defers until branch promotion, or blocks. The design treats observation before commitment as an effect distinct from read/write state mutation. We are not aware of prior work that formulates or evaluates privacy policy at the speculative-issue boundary. The closest existing baseline is Speculative Interaction Agents (SIA) (Hooper et al., 2026), which restricts speculation to read-only tools, but its restriction does not transform what reaches the observer and does not change the inference an adversary can draw from the trace. We make three contributions:

runtime, frozen frontiers, and multiple observer adversaries to be released for verification.

2

Background and Motivation

Tool use turns language agents into distributed systems. A single user request can pull in model services, data systems, user-context stores, and enterprise APIs. In the standard synchronous loop, the model proposes a tool call, the runtime executes it, and the model waits for the result before continuing. The agent walks a committed trace, one call at a time, and the loop is simple but slow when tools have network latency or a task needs many calls. From slow loops to speculation. The standard escape from a slow sequential loop is lookahead. CPUs hide pipeline stalls with branch prediction; storage systems hide I/O latency with prefetching; agent runtimes do both at the tool boundary, predicting likely next calls and issuing them while the planner is still deciding which branch to take. Lookahead at the tool boundary is speculative tool execution. The predicted invocations are speculative tool calls: tool invocations issued before the agent has selected the branch that requires them. Concrete forms include (i) prefetching likely search or retrieval results, (ii) launching predicted API calls in parallel, (iii) resolving candidate entities before the final plan is known, and (iv) issuing duplicate or alternative calls before a previous call has failed. The defining property is abandonment risk: parallel calls all belong to a committed plan, whereas speculative calls may later be abandoned. Adjacent optimizations. Recent tool-calling systems expand speculation in different places. PASTE, Speculative Actions, Dynamic and Interactive Speculative Planning, and Speculative Interaction Agents broaden the lookahead horizon at the tool boundary (Sui et al., 2026; Ye et al., 2026; Guan et al., 2026; Hua et al., 2025; Hooper et al., 2026); in-engine token-level drafting of tool calls or schemas adds speculation inside the modelserving layer (Nichols et al., 2025; Xia et al., 2026); future-based asynchronous function calling overlaps decoding and execution whenever dependencies permit (Feng et al., 2026); transactional systems handle consistency of state-changing speculative effects (Mohammadi et al., 2026). Each reasons about correctness, idempotence, or stateupdate equivalence on the chosen plan, not about what each speculative call reveals to the observer

• The ghost-tool-call concept and the issuetime vs commit-time distinction, with a trace model that compares the issued trace against a committed-only counterfactual. • Speculative Tool Privacy Contracts as an issuetime runtime abstraction with concrete labels, five actions, and a soundness invariant. • An empirical comparison of 12 policies across three generated corpora plus a 66-task AgentDojo external-validity subset, with prototype 2

that receives it. Our work adds a privacy axis to whatever speculative regime a runtime adopts. We do not argue against speculation; we argue that speculation needs an issue-time policy on what crosses the runtime boundary.

Typical visibility

Provider

Tool, endpoint, tenant, arguments, timestamps, sizes, provider logs. Destination, timing, sizes, retries, traffic shape (TLS hides plaintext args). Full trace including branch labels, transformed arguments, cache keys. Cache occupancy, lock contention, queueing delay, rate-limit residue. Whatever the runtime records.

Network Runtime log Co-tenant

The missing effect. Existing abstractions distinguish safe from unsafe speculative calls by taskstate mutation: when the losing branch leaves task state unchanged, the runtime discards it. Privacy needs a separate observation boundary. The observer-visible state from §1 persists at each external observer regardless of whether the branch enters the committed plan.

3

Observer

Auditor

Table 1: Observer projections used in the trace model. Each row lists fields that observer class can recover.

seen had the runtime issued only C from the start, with no pre-commit speculation. (This is not S restricted to C: speculative events perturb provider-side timing, cache state, retry counters, and rate-limit ledgers.) The marginal exposure is ∆i = Oi (S) \ Oi (C): the ordered multiset of (arguments, destination, metadata) tuples and field deltas observer i sees in S but not in C. When the question is semantic rather than field-level, we measure inference advantage: the increase in an adversary’s probability of recovering a sensitive label given Oi (S) versus Oi (C).

Ghost Calls and the Privacy Boundary

Let an agent runtime maintain candidate branches and label each tool event e before dispatch. The issued trace S is the ordered log of every dispatched tool event; the committed trace C ⊆ S is the ordered subsequence whose results or side effects the runtime ultimately uses. A speculative frontier is the set of candidate calls issued before the runtime has committed to the branch requiring them. A speculative call is promoted if its result becomes part of C and abandoned otherwise. A ghost tool call is an abandoned speculative event with a nonempty externally observable projection. Disclosure channels. A tool event can disclose through three channels. Arguments, the literal payload of the call, often carry the sensitive fact directly: a speculative search for “tenant rights lease termination penalty” reveals the user’s frame to the provider whether or not the result is used. Destination, the endpoint, host, or collection, can disclose topical intent independent of payload: a retrieval routed to an HR-leave, oncology, immigration, or security collection encodes the agent’s interpretation of the task even with an empty query, so collection layout and access-control design become part of the privacy surface. Metadata, including tool name, sizes, order, timing, retry counts, cache state, and branch traces, is deployment-sensitive but exploitable when destinations discriminate, caches are shared, or logs preserve branch status.

Promoted versus abandoned. Ghost calls (abandoned speculative events) lie in S \ C by construction, so their projections contribute to ∆i whenever observer i records anything about them. Promoted speculative events appear once on the wire whether the agent speculated or not, so they appear in ∆i only against observers that preserve ordering or timing: a provider logging only canonical arguments and destination receives the same record as in the no-speculation counterfactual, while a provider that timestamps requests records the speculativephase timestamp instead of the would-be commitphase one. Throughout, ghost tool call names the strict abandoned-event case; pre-commit disclosure names the broader category that also includes promoted speculative events under timing- or orderingsensitive observers. The monitor in §4 evaluates every speculative event at issue time regardless of later promotion, because disclosure happens at issue time and the runtime cannot retract it. A worked trace with S, C, Oi (S), Oi (C), and ∆i is in Appendix A.1.

Observer projections. For observer class i, write Oi (·) for the projection of a trace into the channels observer i can recover; different observers preserve different subsets (Table 1). Then Oi (S) is what i actually records, and Oi (C) is the committedonly counterfactual: the projection i would have

Proposition 1 (No commit-time erasure). Assume observer i persists observations outside the runtime’s commit boundary. If a ghost call g emits a nonempty projection Oi (g) at issue time, no policy that executes only after branch commitment can remove that projection from observer i’s prior view. 3

Field

Meaning

Execution mode

committed, speculative, prefetch, retry, validation, shadow. pure-local, local-read, external-read, external-write, semi-stateful, irreversible. provider, network, runtime log, cotenant, auditor. public, personal, sensitive, intentrevealing. public, tenant-internal, sensitive, regulated, forbidden. calibrated commit estimate; cumulative per-task disclosure budget. which observer (if any) receives the audit record of this event.

Effect class Observer class Argument labels Destination label Branch confidence / budget Audit policy

Trusted boundary. The monitor sits between the planner and every externally observable IO path. Tool providers, network infrastructure, shared caches, audit sinks, retry queues, telemetry exporters, tracing spans, rate-limit ledgers, and authtoken minting all sit behind the monitor: raw speculative arguments must not enter logs, queues, metrics, traces, or caches before a policy decision. The Trusted Computing Base (TCB) contains the planner, the speculation controller, the contract monitor, and the dispatcher up to external dispatch. Our threat model trusts the planner and leaves modelprovider mediation to future work (Limitations).

Table 2: Fields the monitor binds to each speculative event before dispatch.

Decision function. For a proposed event e under contract κ, the monitor computes D(e, κ) → {ALLOW, REWRITE, SHADOW, DEFER, BLOCK} as a fail-closed pipeline (any missing label or uncovered case maps to D EFER or B LOCK, never silently to A LLOW): B LOCK if the tool or destination is outside κ’s allow-list; D EFER if the event is speculative and its branch confidence falls below κ’s threshold; R EWRITE if any argument is labeled HIGH-sensitivity; S HADOW if a non-providervisible substitute is required and the destination is external; D EFER if the per-task disclosure budget is exceeded; otherwise audit and A LLOW. The audit hook records the decision and transformed fields; raw speculative arguments never persist unless κ explicitly grants that observer. Pseudocode in Appendix A.

Once a provider, network observer, shared cache, or audit log has received the external trace of g, the runtime cannot retroactively unsend it. Rollback works for state effects because a runtime can delay or compensate writes (Mohammadi et al., 2026); observation effects sit outside that boundary. Issuetime is therefore the only enforcement point for externally observable speculative dispatch. Proposition 2 (Read-only is not observationfree). Read-only authorization does not imply privacy preservation under speculation: read-only ghost calls can emit nonempty observer projections through any of the three channels above. Designs that permit speculation only for read-only tools (Hooper et al., 2026) protect against state mutation, not observation.

4

Actions. A LLOW dispatches the event unchanged. R EWRITE applies a declared transformation (entity redaction, time-range coarsening, intent-phrase replacement) before dispatch. S HADOW executes a trusted-local substitute and marks the result non-provider-visible. Our prototype reuses the substituted result if the runtime later promotes the speculative call to the committed plan, so substitute quality conditions downstream task success; a cleaner refinement would re-issue the call against the real provider on promotion, when the committed plan justifies the disclosure. D E FER queues the event for re-evaluation on branch promotion; abandoned branches terminate without external dispatch. B LOCK drops the event with a policy denial. Every event traverses four states with explicit guards (Issued → Decided → Dispatched → Completed); promotion of a previously D EFERRED event re-runs D(e, κ) as a committed event before external dispatch.

Speculative Tool Privacy Contracts

Speculative Tool Privacy Contracts make the observer-visible-before-commit effect explicit and attach policy decisions to it. Why a multi-field vocabulary and not a scalar risk level? Collapsing the vocabulary to a single (mode, risk-level) pair would force every policy to encode its decision inside a policy-specific risk function. That relocates the complexity. Different policies read different fields: Rewrite reads argument sensitivity, Shadow reads destination, Gate reads branch confidence, Drop reads sensitivity anywhere. Sensitivity and confidence are also orthogonal in our measurements (the Gate lever in Table 17 lives in the high-sensitivity, low-confidence quadrant a scalar would flatten), and one destination yields multiple observer projections, so policies must track ∆i per observer. 4

Theorem 1 (Soundness under complete mediation). Assume (A1) complete mediation: every speculative or committed event reaches the dispatcher only through the monitor, and no telemetry, retry queue, cache, or audit sink receives raw event fields before the monitor decides; (A2) label correctness: labels correctly classify each event’s destination, arguments, and effect class; (A3) action preservation: rewrites and shadow substitutes preserve their declared field-label restrictions (a Rewrite transforming an intent-revealing argument yields a generic argument that no longer carries the forbidden label; a Shadow substitute does not externally emit the forbidden field). Under A1–A3, the monitor’s evaluation of D(e, κ) at issue time prevents any field of any label ℓ that κ forbids at observer i from entering ∆i , regardless of whether the event is later committed, abandoned, deferred, or promoted. Each of A1–A3 is necessary. Appendix A formalizes the event schema, label lattice, and action semantics.

5

are Naive (no policy, every candidate dispatches) and No-Spec (committed plan only, no speculation). Post-hoc filters act after a call has already issued: SIA (Speculative Interaction Agents) admits only read-only tools (Hooper et al., 2026); ACL gates dispatch by a per-tool allow-list; Late-Scrub scrubs the issued trace after branch commitment. Issue-time transformations change what reaches the observer before dispatch. Pre-Scrub is an issuetime DLP-style weak baseline: it runs a free-text PII regex before issue, which leaves structured argument and destination fields untouched. Rewrite paraphrases sensitive arguments into generic equivalents; Shadow routes the call to an internal substitute whose result is non-provider-visible; Gate defers low-confidence speculative calls until branch selection; Taint blocks calls with substring matches to hand-curated taint sources; and Taint-F tracks taint at field granularity. The refusal baseline, Drop, rejects any call tagged sensitive. SIA is the only directly attributable prior speculative-agent baseline. ACL, Pre-Scrub, and Late-Scrub instantiate standard allow-listing, free-text redaction, and post-hoc transcript scrubbing; Taint and Taint-F adapt classical IFC ideas (Denning, 1976; Myers, 1999); Naive and No-Spec are the speculative and non-speculative endpoints; Rewrite, Shadow, and Gate are contract actions.

Evaluation

We ask whether speculative provider-visible traces support an issue-time privacy claim and which controls shrink the resulting marginal exposure ∆i . We measure adversarial recovery of a hidden sensitive label from observer projections, not final-answer correctness. We use three corpora plus an AgentDojo external-validity subset, with sizes stated per RQ; Claude Opus 4.7 is the primary adversary. Appendix B gives the full tables. Setup. The prototype is a Python contract dispatcher over five tool adapters (web search, document retrieval, calendar lookup, CRM lookup, email search), each carrying effect, argumentprivacy, and destination-privacy labels. We swap in a Brave Search adapter for the real-provider study. Each closed-set adversarial inference picks one of the per-corpus labels from the projection it sees; we hold the speculative frontier byte-identical across paired replays and vary the dispatcher policy, so sign tests use the matched (task, seed) structure. The planner emits a median of 8 speculative candidates per task with mean ghost-call rate 82–89% across corpora (Appendix B.20). We organize the evidence around five research questions.

RQ1: Do speculative traces leak inferred intent? Yes. The gap is large, and it survives moving from a static plan to a real LLM planner. Mechanism. 30 hand-crafted tasks with fixed committed plans, three seeds, Opus 4.7 adversary (Table 6). Holding the committed plan constant isolates the ghost-call contribution: recovery climbs from 0.44 under No-Spec to 0.97 under Naive; LateScrub, SIA, and ACL track Naive at 0.97. Only Rewrite (0.53) and Shadow (0.42) move the metric. Realism. The same 30 tasks under a SpeculativeAgent LLM planner (three seeds; Table 7): Naive recovers 0.49, Shadow 0.00, Rewrite 0.04. The Naive-equivalent cluster persists; Rewrite and Shadow remain near the floor without a heldconstant plan. Speculative dispatch produces a large, mechanistically attributable leak; post-issue scrubs cannot retract it. Appendix B reports per-policy CIs and call counts.

Policies and baselines. We compare twelve policies that share the same speculative frontier and differ only in dispatcher behavior. The endpoints

RQ2: Which controls reduce leakage? Only issue-time transforms. We rule out a plannerfrontier confound by replaying one Naive-sampled 5

planner trace per (task, seed) through every policy. Paired-frontier replay. Figure 2 uses 150 tasks × 3 seeds, or 450 paired trials per policy; Table 8 gives the full numbers. The speculative frontier is identical across policies, and only the dispatcher decision changes. Four policies that do not change the structured projection (Pre-Scrub, Late-Scrub, ACL, SIA) cluster with Naive: LateScrub and ACL have zero delta; Pre-Scrub is statistically indistinguishable (p=0.31); SIA is the only policy with a statistically significant positive delta (+0.02, p=0.04), worse than Naive on this corpus because its read-only allow-list passes exactly the search/retrieve/lookup calls that carry the most intent signal. This is the leak: utility is preserved because the provider projection is preserved. Rewrite and Shadow reduce recovery at p<0.0001; a field-sensitive provenance variant (Taint-F) cuts the residual signal by ≈ 32% (Naive 0.104 → Taint-F 0.071). We also implement a stronger IFC baseline modeled after FIDES (Costa et al., 2025) with typed source declarations, a typed sink table, and field-level taint propagation: it reaches 0.131 recovery on the same corpus, worse than Rewrite (0.029) and Shadow (0.000), and within CI of Naive (0.104). The contract abstraction’s transformation actions are not subsumed by careful IFC labeling. Scale. The pattern reproduces on the 150-task unpaired pooled corpus (Table 9). Absolute recovery drops as the candidate-label space grows from 30 to 150 (chance falls from ≈0.033 to ≈0.0067), but the four Naive-equivalent baselines stay within 0.02 of Naive, Rewrite at 0.02, Shadow at 0.00. The 150-task paired-replay Naive–No-Spec gap is smaller than the 30-task static gap because paired replay does not hold the committed plan constant; the static-plan benchmark, which does, attributes the gap mechanistically to ghost calls. Label-noise robustness. The soundness invariant rests on correct labels. False-negative noise that downgrades SENSITIVE/INTENT-REVEALING arguments and SENSITIVE destinations to PUBLIC at 5/10/20% on the 150-task paired replay (Haiku adversary): at 20%, Shadow at 0.08 and Rewrite at 0.06 remain significantly below noisy Naive, and the Naive-equivalent cluster stays within 0.01 spread. The ranking survives plausible classifier error; full sweep in Table 10. Under byte-identical speculative input, postissue scrubs do not move the metric; SIA preserves the same provider signal as Naive. The result holds

at 5× scale and under 20% label noise. RQ3: What carries the residual signal? Destination URLs and structured argument fields, not tool names. Tool-name masking. Replacing every projection’s tool name with a generic placeholder on the 30-task real-planner corpus produces zero delta for both Naive (0.49 with and without names) and Pre-Scrub (0.47 with and without); 25 of 30 pertask predictions match across conditions per seed. The residual signal lives in destination URL paths that literally name the topic and in structured argument fields whose values a free-text personallyidentifiable-information (PII) regex does not cover. Channel isolation. A 9-task seed ablation drops one channel at a time under Naive (Table 11): full projection 9/9 → args+names only 9/9 (argument dominates) → dest+names only 5/9 (destination contributes) → names only 3/9 (the floor). Anonymized destinations. On a seed-1 anonymization rerun of the 150-task paired-replay, neutralizing every destination URL shifts Naive recovery from 0.113 to 0.127 (paired CI overlaps zero) and leaves Rewrite/Shadow unchanged. The argument channel carries the leak on its own; topicbearing destinations amplify rather than originate it. A 30-task enterprise-style corpus with anonymous endpoints by construction reproduces the ordering: Naive 1.00, Shadow 0.00, Rewrite 0.09 (Appendix B.16). A PII redactor that operates on free text but leaves structured destination and argument schemas untouched is, in our measurements, indistinguishable from no redaction. Effective controls must transform the structured projection (Rewrite) or replace the destination (Shadow). RQ4: Do the findings hold under different adversaries and a real provider? Yes, on every axis we tested. Cross-adversary. Rescoring the same projections under three model families (Opus 4.7, Haiku4.5, GPT-4o-mini; Table 12) preserves the policy ranking within each model: Naive, Pre-Scrub, LateScrub, and ACL tie at the top; Shadow at 0.00 and Rewrite at 0.03 hold the floor. Pooled closed-set recovery is 0.33 (Opus), 0.25 (Haiku), 0.22 (GPT4o-mini). Semantic open-set matching (sentenceembedding cosine) reaches 0.13 on Opus, roughly 5× the strict-lexical floor. Non-LLM baselines (keyword 0.06, TF-IDF 0.08; Table 13) trail LLM adversaries 4–5×; a corpus leave-one-out Naive 6

Shadow Rewrite Taint Taint-F Drop Gate No-Spec Late-Scrub ACL Naive (ref) Pre-Scrub SIA

sign-test p < 0.05 not significant

−0.16 −0.14 −0.12

−0.1 −8 · 10−2 −6 · 10−2 −4 · 10−2 −2 · 10−2

0

2 · 10−2 4 · 10−2 6 · 10−2

Paired ∆ vs. Naive

Figure 2: Paired-replay leakage by policy on 150 tasks and three seeds (n=450 per policy). Points show ∆ in adversary recovery relative to Naive; negative values mean less leakage. Filled markers have sign-test p<0.05; the diamond marks Naive.

Bayes adversary trained on per-task labels reaches 0.65, an upper bound the LLM does not approach. Metric robustness. The policy ranking holds under top-k accuracy (k=1, 3, 5; Spearman 0.83 against top-1), normalized mutual information, and an open-set semantic adversary on the 150-task corpus. Critically, a decoy-label adversary that sees the true label mixed with 10 unrelated decoys (chance ≈ 0.091) recovers the true label at 0.90– 0.93 on the Naive cluster — the adversary discriminates via projection content, not via candidate-list recognition. Shadow holds the floor under every alternative metric (Appendix B.14). Real provider. A Brave Search sanity check (9 tasks, 1 seed) gives Naive 0.67 and Rewrite 0.44; a 30-task × 3-seed DuckDuckGo run reproduces the gap with non-overlapping 95% CIs (Naive 0.49, Rewrite 0.04; Table 15). The speculative search still happens, but the literal string reaching the provider under Rewrite is generic. Async wall-clock. Single-tool DuckDuckGo overlap saves 5.4% at p50 (Table 14); a multi-tool workload with ≥ 3 parallel speculative calls saves 12.3% at p50, with Contract-async (Rewrite, Gate, Taint-F) within 1.5 pp of Naive-async; Shadow is 2.7 pp slower because local substitutes shift the overlap window (Appendix B.17). Contract enforcement is not the latency bottleneck. External validity. 66 AgentDojo tasks (Table 3) reproduce the policy ordering qualitatively at one seed: the let-through baselines (Naive and SIA) tie at 0.75 and Pre-Scrub at 0.85 on privacy-bearing prompts, Taint at 0.13, and Rewrite and Shadow at 0.00. AgentDojo prompts name sensitive topics directly, so absolute numbers run high. The

Policy Naive SIA† Pre-Scrub Taint Rewrite Shadow

Adv. recovery

FP rate

Calls

0.750 0.750 0.846 0.130 0.000 0.000

0.327 0.327 0.308 0.019 0.058 0.000

5.02 5.02 4.92 0.32 5.12 0.03

Table 3: AgentDojo external-validity subset: 66 readonly tasks per policy (20 privacy-bearing + 46 neutral). Privacy-bearing inference rate and neutral-prompt falsepositive rate under a Haiku-4.5 planner/adversary, with none admissible in the closed-set candidate menu. † SIA is read-only by construction on AgentDojo.

closed-set adversary in this table admits a none option, and under that menu Rewrite’s neutral false-positive rate drops to 0.06 from a 1.000 closed-set-menu artifact reported in earlier runs (Appendix B.18). The policy ordering holds across the adversaries we tested, reproduces at the HTTP boundary, and carries to a benchmark with a different threat profile; the contract is not the latency bottleneck. RQ5: What do non-provider observers reveal? Runtime logs reveal nearly as much as providers; network and shared-cache channels do not in this corpus. We measure three additional observer classes from Table 1 on the same 30-task corpus and 12 policies. Runtime log. An adversary that sees tool name, a 20-character per-value argument summary, the dispatcher decision tag, and a 100 ms duration bucket recovers 0.24 pooled, only 0.02 below the same model’s full-projection provider adversary (0.26) on the same traces. Argument truncation is insufficient when summaries and decision tags survive. 7

Network only. An adversary seeing host, port, payload size, and timing recovers 0.04, within sampling noise of the 0.033 random baseline. The traffic-shape claim in §3 needs per-tenant or topicbearing hostnames our corpus does not exercise. Co-tenant cache. A hand-built probe set with oracle access to candidate labels recovers 9/9 tasks; the same protocol learned by cross-validation on a one-task-per-label corpus recovers 0/9. The channel carries the sensitive label; exploitation needs a labeled prior overlapping the victim. Audit logs fold into runtime-log; network/shared-cache channels are deployment-sensitive.

Policy

Task success

Shadow 0.000 [0.000, 0.000] 0.794 [0.739, 0.850] Rewrite 0.033 [0.000, 0.078] 0.794 [0.744, 0.844] Gate (τ =0.7) 0.044 [0.011, 0.089] 0.794 [0.739, 0.850] Drop 0.067 [0.022, 0.122] 0.794 [0.744, 0.844] No-Spec 0.067 [0.022, 0.122] 0.833 [0.783, 0.878] Taint 0.100 [0.044, 0.167] 0.828 [0.778, 0.878] Taint-F 0.122 [0.067, 0.189] 0.800 [0.750, 0.850] Pre-Scrub 0.211 [0.133, 0.311] 0.800 [0.750, 0.850] Late-Scrub 0.233 [0.144, 0.322] 0.783 [0.733, 0.833] SIA 0.233 [0.144, 0.322] 0.778 [0.722, 0.828] Naive 0.256 [0.178, 0.344] 0.783 [0.733, 0.833] ACL 0.256 [0.167, 0.344] 0.772 [0.722, 0.822]

Table 4: Privacy/utility trade-off on a 30-task stratified subset, three seeds (n=90 per policy). Recovery is closed-set leakage; task success is a Haiku-4.5 judge score on final answers.

Cost and Gate calibration. Naive uses 4.0 provider calls/task vs Shadow/No-Spec at 1.0 (static plans); the planner LLM, not the monitor, dominates wall-clock (Table 16). Gate exposes a tunable threshold τ that walks a privacy/utility lever from 0.12 leakage at 5.4 calls/task (permissive τ =0.3) to 0.06 at 0.96 calls/task (strict τ =0.9) on the 150-task paired-replay (Table 17).

cost throttles sensitive-call volume but does not change the projection of issued calls. R EWRITE and S HADOW are orthogonal: they transform percall projection. Agent IFC, guardrails, and side channels. FIDES (Costa et al., 2025), NeuroTaint (Cai et al., 2026), RTBAS (Zhong et al., 2025), and verifiably safe tool-use (Mou et al., 2026; Doshi et al., 2026) gate selected committed tool calls; classical IFC and effect systems (Denning, 1976; Myers, 1999) label data and operations. Contracts add observation-before-commitment as a first-class effect over the speculative frontier. Adjacent sidechannel work (Zhang et al., 2025; Wei et al., 2025; Kocher et al., 2019) studies different objects but shares the Spectre lesson: observations on uncommitted paths escape the intended execution model. Committed-leakage benchmarks (Huang et al., 2026; El Yagoubi et al., 2026; Debenedetti et al., 2024; Ruan et al., 2024; Zhan et al., 2024; Yao et al., 2025) measure attacks on the selected plan, not marginal speculative exposure.

Privacy/utility trade-off. We also measure task success with a Haiku-4.5 LLM-as-judge rubric on a 30-task stratified subset (10 health, 10 employment, 10 finance), all twelve policies, and three seeds (Table 4). Task-success clusters tightly in [0.77, 0.83] with every CI overlapping every other, so the utility axis does not statistically separate the twelve policies; the privacy axis separates them from 0.00 (Shadow) to 0.26 (Naive, ACL). The Pareto frontier has two corners: Shadow at zero leakage, No-Spec at the utility ceiling but no speculative latency advantage (Table 14). Gate at τ =0.7 is a useful middle point (leakage 0.04, task-success 0.79). The post-hoc cluster (Late-Scrub, SIA, ACL) sits at or above Naive on leakage with no utility gain; speculative policies pay at most 0.04 task-success to bring leakage below 0.05.

6

Adv. recovery

Query privacy and contextual integrity. PIR (Chor et al., 1998; Howe and Nissenbaum, 2008) and RAG privacy (Zeng et al., 2024) reduce what a service learns from a query; we ask whether to issue it. Contextual integrity (Nissenbaum, 2004) captures the timing-and-purpose distinction.

Related Work

Speculative tool execution. Speculation at the tool boundary is established practice (Sui et al., 2026; Ye et al., 2026; Guan et al., 2026; Hua et al., 2025; Hooper et al., 2026; Nichols et al., 2025; Xia et al., 2026; Feng et al., 2026; Mohammadi et al., 2026); we add an issue-time privacy abstraction on top, not speculation itself. SIA is the closest issuetime baseline; Proposition 2 rules out its read-only restriction. These runtimes already balance tokenand-API cost against latency; encoding privacy as

7

Conclusion

Speculative tool execution creates an issue-time privacy failure: a not-yet-needed call discloses intent before commitment. Speculative Tool Privacy Contracts treat observation-before-commit as a firstclass effect; only issue-time controls suppress it. 8

Limitations

a clinically-named search before commit). PreScrub and Late-Scrub drop sensitive substrings after dispatch but leave the issued query topical. SIA’s read-only restriction permits topical search() calls that name the sensitive subject (the failure Proposition 2 formalizes). Taint and Taint-F inherit labeler fragility: too-narrow vocabulary under-blocks paraphrase, and field-level taint still trusts the labeler on argument fields. FIDES-style IFC accepts topical flow on accept-setcompatible endpoints. Rewrite can leak when its abstraction is too thin; Shadow trades external dispatch for substitute fidelity; Gate fails open when the calibrator under-estimates ghost-call probability; Drop over-refuses on any labeler false positive, sacrificing utility; No-Spec forgoes speculation entirely, sacrificing latency. The body’s pairedfrontier numbers measure how often each of these fires.

Complete mediation. Speculative Tool Privacy Contracts rely on complete mediation: any client library, cache, retry path, metric, trace, audit sink, or credential path that receives raw speculative fields before the monitor runs violates the model and the soundness invariant no longer applies. Label correctness. The policy depends on labels and confidence estimates; missing annotations and classifier failures fail closed, trading utility for privacy. Mislabeling an intent-revealing argument as benign, or an external destination as local, can let a forbidden field reach an observer. The prototype’s rule-based labeler reaches macro-F1 0.10 on argument sensitivity, 0.59 on destination, and 0.45 on effect against an Opus-4.7 gold annotator on n=394 events (Table 18; details in Appendix B.19). The paired-frontier comparison is robust to this gap because the same labeler is applied across all policies; absolute guarantees require a stronger labeler.

References

Model-provider trust assumption. We treat the model-serving layer as trusted in our threat model. In deployments where the planner is a remote LLM, the model provider can observe user input, candidate branches, and tool schemas before the contract monitor runs; we leave model-provider contracts to future work.

Yuandao Cai, Wensheng Tang, Cheng Wen, and Shengchao Qin. 2026. Ghost in the agent: Redefining information flow tracking for LLM agents. Preprint, arXiv:2604.23374. Benny Chor, Eyal Kushilevitz, Oded Goldreich, and Madhu Sudan. 1998. Private information retrieval. Journal of the ACM, 45(6):965–981.

Adversary coverage. We use Claude Opus 4.7, Claude Haiku-4.5, and GPT-4o-mini together with keyword, TF-IDF, and corpus-LOO Naive Bayes baselines, but we have not tested sub-10B openweight models, human analysts, or adversaries with private labeled traces from the target deployment.

Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2025. Securing AI agents with information-flow control. Preprint, arXiv:2505.23643.

Shadow substitute fidelity. Reported tasksuccess under Shadow is conditional on substitute quality; the privacy claim is independent because the speculative-phase substitute already prevents the disclosure regardless of what happens at promotion.

Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems, volume 37, pages 82895–82920. Curran Associates, Inc.

Channel and latency coverage. We measure provider, runtime-log, network, and one sharedcache channel; multi-tenant contention, queueing, rate-limit residue, and inter-agent disclosure remain unmeasured. The latency numbers are ordinal policy costs, not production speedups.

Dorothy E. Denning. 1976. A lattice model of secure information flow. Communications of the ACM, 19(5):236–243. Aarya Doshi, Yining Hong, Congying Xu, Eunsuk Kang, Alexandros Kapravelos, and Christian Kästner. 2026. Towards verifiably safe tool use for LLM agents. In Proceedings of the 48th IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER ’26), Rio de Janeiro, Brazil. Association for Computing Machinery.

Concrete failure modes per policy. Naive and ACL leak by construction: any latent-intent prompt issues a topical query to a permitted endpoint (e.g., 9

Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. 2026. AgentLeak: A full-stack benchmark for privacy leakage in multi-agent LLM systems. Preprint, arXiv:2602.11510.

Andrew C. Myers. 1999. JFlow: Practical mostly-static information flow control. In Proceedings of the 26th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL ’99), pages 228– 241. Association for Computing Machinery.

Guangyu Feng, Huanzhi Mao, Prabal Dutta, and Joseph E. Gonzalez. 2026. Concurrency without model changes: Future-based asynchronous function calling for LLMs. Preprint, arXiv:2605.15077.

Daniel Nichols, Prajwal Singhania, Charles Jekel, Abhinav Bhatele, and Harshitha Menon. 2025. Optimizing agentic language model inference via speculative tool calls. Preprint, arXiv:2512.15834.

Yilin Guan, Qingfeng Lan, Fei Sun, Dujian Ding, Devang Acharya, Chi Wang, William Yang Wang, and Wenyue Hua. 2026. Dynamic speculative agent planning. In Proceedings of the Fourteenth International Conference on Learning Representations (ICLR 2026). OpenReview.net.

Helen Nissenbaum. 2004. Privacy as Contextual Integrity. Washington Law Review, 79(1):119–158. Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. 2024. Identifying the risks of LM agents with an LMemulated sandbox. In Proceedings of the Twelfth International Conference on Learning Representations (ICLR 2024). OpenReview.net.

Coleman Hooper, Minwoo Kang, Suhong Moon, Nicholas Lee, Eric Wen, John Wawrzynek, Michael W. Mahoney, Yakun Sophia Shao, Amir Gholami, and Kurt Keutzer. 2026. Speculative interaction agents: Building real-time agents with asynchronous I/O and speculative tool calling. Preprint, arXiv:2605.13360.

Yifan Sui, Han Zhao, Rui Ma, Zhiyuan He, Hao Wang, Jianxun Li, and Yuqing Yang. 2026. Act while thinking: Accelerating LLM agents via pattern-aware speculative tool execution. Preprint, arXiv:2603.18897.

Daniel C. Howe and Helen Nissenbaum. 2008. Trackmenot: Resisting surveillance in web search. In Ian Kerr, Valerie Steeves, and Carole Lucock, editors, Lessons from the Identity Trail: Anonymity, Privacy and Identity in a Networked Society, pages 417–436. Oxford University Press.

Jiankun Wei, Abdulrahman Abdulrazzag, Tianchen Zhang, Adel Müürsepp, and Gururaj Saileshwar. 2025. When speculation spills secrets: Side channels via speculative decoding in LLMs. OpenReview submission to the Fourteenth International Conference on Learning Representations (ICLR 2026).

Wenyue Hua, Mengting Wan, Jagannath Shashank Subramanya Sai Vadrevu, Ryan Nadel, Yongfeng Zhang, and Chi Wang. 2025. Interactive speculative planning: Enhance agent efficiency through co-design of system and user interface. In Proceedings of the Thirteenth International Conference on Learning Representations (ICLR 2025). OpenReview.net.

Heming Xia, Yongqi Li, Cunxiao Du, Mingbo Song, and Wenjie Li. 2026. ToolSpec: Accelerating tool calling via schema-aware and retrieval-augmented speculative decoding. Preprint, arXiv:2604.13519. Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik R. Narasimhan. 2025. τ -bench: A benchmark for Tool-Agent-User interaction in real-world domains. In Proceedings of the Thirteenth International Conference on Learning Representations (ICLR 2025). OpenReview.net.

Tao Huang, Chen Hou, Guosen Wu, and Jiayang Meng. 2026. Observable channels, not just storage: Evaluating privacy leakage in LLM agent pipelines. Preprint, arXiv:2603.22751. Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2019. Spectre attacks: Exploiting speculative execution. In Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), pages 1–19. IEEE.

Naimeng Ye, Arnav Ahuja, Georgios Liargkovas, Yunan Lu, Kostis Kaffes, and Tianyi Peng. 2026. Speculative actions: A lossless framework for faster AI agents. In Proceedings of the Fourteenth International Conference on Learning Representations (ICLR 2026). OpenReview.net.

Bardia Mohammadi, Nearchos Potamitis, Lars Henning Klein, Akhil Arora, and Laurent Bindschaedler. 2026. Atomix: Timely, transactional tool use for reliable agentic workflows. In Proceedings of the ICLR 2026 Workshop on Agents in the Wild: Safety, Security, and Beyond (AIWILD). OpenReview.net.

Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2024. The good and the bad: Exploring privacy issues in retrievalaugmented generation (RAG). In Findings of the Association for Computational Linguistics: ACL 2024, pages 4505–4524, Bangkok, Thailand. Association for Computational Linguistics.

Yutao Mou, Zhangchi Xue, Lijun Li, Peiyang Liu, Shikun Zhang, Wei Ye, and Jing Shao. 2026. ToolSafe: Enhancing tool invocation safety of LLMbased agents via proactive step-level guardrail and feedback. Preprint, arXiv:2601.10156.

Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for

10

Computational Linguistics: ACL 2024, pages 10471– 10506, Bangkok, Thailand. Association for Computational Linguistics. Yixiang Zhang, Xinhao Deng, Zhongyi Gu, Yihao Chen, Ke Xu, Qi Li, and Jianping Wu. 2025. Exposing LLM user privacy via traffic fingerprint analysis: A study of privacy risks in LLM agent interactions. Preprint, arXiv:2510.07176. Peter Yong Zhong, Siyuan Chen, Ruiqi Wang, McKenna McCall, Ben L. Titzer, Heather Miller, and Phillip B. Gibbons. 2025. RTBAS: Defending LLM agents against prompt injection and privacy leakage. Preprint, arXiv:2502.08966.

11

A

Contract Mechanism Details

drops e with a policy denial and records an audit entry per κ.audit_policy.

This appendix gives the event schema, label lattice, action semantics, decision-function pseudocode, prototype implementation notes, a worked contract example, and a worked example of the trace model on the motivating vignette of §1.

Disclosure budget. A contract κ may impose a per-task budget b on the number of SENSITIVEargument or INTENT- REVEALING-argument dispatches. The monitor increments a counter on every A LLOW or R EWRITE; once the counter reaches b, subsequent qualifying candidates fall through to D EFER. Budgets are reset at task boundaries.

Event schema. Each tool event is a tuple e = (tool, args, destination, mode, t), where tool identifies the adapter, args is a dictionary of named argument fields, destination is the externally observable endpoint or collection, mode ranges over the six execution modes of Table 2, and t is the issue timestamp. Each argument field carries a sensitivity label from Larg (public, personal, sensitive, intent-revealing); the destination carries a label from Ldest (public, tenant-internal, sensitive, regulated, forbidden).

Worked contract example. For a web-search tool, a default contract might specify: allowed_tools = {web_search}; allowed_destinations = {api.brave.com, api.duckduckgo.com}; max_arg_label = PERSONAL (block SENSITIVE and INTENT- REVEALING); τ = 0.7 for speculative dispatch; b = 5 sensitive dispatches per task; audit to runtime log. Under this contract, a speculative web_search(q=“tenant rights lease termination penalty”), with the query field labeled INTENTREVEALING, triggers R EWRITE to a generic query before dispatch. A committed call with c=1.0 for the same query would also R EWRITE (the contract does not authorize intent-revealing fields to the provider) but the rewrite is justified at commit time and is no longer speculative.

Label lattice. Both Larg and Ldest are totally ordered by least-restrictive to most-restrictive (public < personal < sensitive < intent-revealing for arguments; public < tenant-internal < sensitive < regulated < forbidden for destinations). A contract κ specifies a forbidden cut: arguments at or above κ.max_arg_label must not reach an observer i that κ does not authorize. Labels are assigned by a deterministic rule-based labeler that runs over each event before the monitor sees it; the labeler is a pure function of (tool, args, destination) and is independent of the policy.

Decision-function pseudocode. The body summarizes the monitor’s logic in §4; the full failclosed pipeline is: function decide(event e, contract k): if e.tool not in k.allowed_tools: return BLOCK if labels(e).destination not in k.allowed_destinations: return BLOCK if e.is_speculative and e.conf < k.branch_threshold: return DEFER if any(arg.sensitivity == HIGH for arg in e.args): return REWRITE(scrub(e.args, k)) if k.shadow_required and labels(e).dest == EXTERNAL: return SHADOW(internal) if budget_exceeded(k, e): return DEFER audit(e, k, ALLOW) return ALLOW

Branch confidence. The planner emits a perbranch confidence c ∈ [0, 1] alongside each speculative candidate, prompted to give a calibrated commit probability. Gate consumes this directly: a candidate with c < κ.τ is D EFERRED. Confidence calibration is not a contract concern and any source of c that satisfies c ∈ [0, 1] is admissible. Action semantics. A LLOW(e) dispatches e to its destination unchanged. R EWRITE(e) replaces every argument field at or above κ.max_arg_label with a generic equivalent that the labeler assigns a strictly lower label, then dispatches the resulting event. S HADOW(e) routes e to a trusted-local substitute and marks the result non-provider-visible; the substitute is a function of (tool, args) and never touches an external observer. D EFER(e) buffers e; if the speculative branch is promoted to the committed plan, the monitor re-runs D(e, κ) as a committed event and may dispatch then. B LOCK(e)

Prototype implementation. The prototype is a Python runtime on a tool-adapter abstraction with a contract-policy hook on the dispatch path. The static-plan harness exposes five mock tools (web search, document retrieval, calendar lookup, CRM lookup, email search); each tool carries a con12

Contract action. Under issue-time REWRITE on the argument channel, the monitor dispatches e2 with a generic query that does not reveal an apartment search. Under issue-time SHADOW on the destination channel, the monitor routes e3 to a trustedlocal substitute so the loan-rates provider never receives the speculative request. Both transformations apply at issue time, to ghost calls, and shrink ∆prov before any externally observable event.

tract with effect, argument-privacy, and destinationprivacy labels. For the real-provider experiment we swap in a Brave Search adapter in place of the mock web-search tool. The real-planner path uses an LLM planner that emits speculation candidates and a committed plan; both flow through the same contract-action dispatcher, with the default branchconfidence threshold set to τ =0.7. Two observer helpers record (i) tool name, a bounded argument summary, dispatcher decision, and 100 ms duration bucket; and (ii) timestamps with synthetic cachehit flags over canonicalized tool-name and argument keys. The static experiments use simulated harness latencies (web search 200 ms, document retrieval 100 ms, calendar 50 ms, CRM 80 ms, email 120 ms). A.1

B

This appendix collects the per-corpus tables behind every measurement in §5. Subsections appear in the order their results are referenced in the body. B.1

Experiment matrix

Table 5 maps each corpus to its planner, provider, policy set, and result location.

Worked trace example

We instantiate the trace model on the motivating example from §1. A user query “What’s the penalty for breaking my lease early?” induces a speculative frontier of three tool calls, of which the agent later commits to one.

B.2

Static-plan benchmark

Table 6 reports the static-plan headline from RQ1 Mechanism. B.3

Issued trace S.

30-task real-planner

Table 7 reports the real-LLM-planner numbers from RQ1 Realism, per-seed and pooled.

1. e1 = (web search, q1 = “tenant rights lease termination penalty”, external, t = 0.1 s) 2. e2 = (web search, q2 = “available apartments near me”, external, t = 0.15 s) 3. e3 = (loan-rates API, q3 = “current personal loan rates”, external, t = 0.25 s)

B.4

150-task paired-frontier replay

Table 8 reports the full numbers behind Figure 2 (RQ2 Paired-frontier replay). B.5

150-task pooled corpus

Table 9 reports the unpaired pooled numbers from RQ2 Scale.

The agent commits to a tenant-rights answer that uses only the first search. Committed trace C. are abandoned.

Evaluation Tables

B.6

Label-noise robustness

Table 10 reports the false-negative label-noise sweep referenced in RQ2 Label-noise robustness. Noise downgrades SENSITIVE/INTENTREVEALING argument labels and SENSITIVE destination labels to PUBLIC at the specified rate so the monitor lets the call through.

e1 is promoted; e2 and e3

Provider projection vs. counterfactual. Each provider records its own issued query plus timestamp and destination. The search provider sees e1 and e2 ; the loan-rates provider sees e3 . Had the agent issued only the committed call from the start, the search provider would have seen only e1 and the loan-rates provider would have seen nothing. The marginal exposure ∆prov = Oprov (S) \ Oprov (C) = {e2 , e3 } is the two ghost calls; from these the adversaries can recover that the user is shopping for apartments and pricing personal loans, an inference the user never asked the agent to express.

B.7

Channel-isolation ablation

Table 11 reports the channel-isolation ablation from RQ3 Channel isolation. On the 30-task real-planner corpus, the complementary tool-name-masking probe leaves pooled accuracy unchanged (0.489 with and without tool names for Naive; 0.467 with and without names for Pre-Scrub; 25 of 30 per-task predictions match across conditions per seed). 13

Corpus

N

Seeds Planner

Provider Policies

Adversary

Reported in

Static-plan 30 Real-planner 30 Pooled 150 (paired) Pooled 150 (unpaired) Task-success 30 Brave 9 Async-latency 30 (DDG) AgentDojo 66 Channel-isolation 9 (seed)

30 30 150 150 30 9 30 66 9

3 3 3 3 3 1 3 1 1

mock mock mock mock mock Brave DDG mock mock

Opus 4.7 Opus 4.7 Opus 4.7 Opus 4.7 Haiku-4.5 (judge) Opus 4.7 Haiku-4.5 Haiku-4.5 Opus 4.7 (per-view)

Tab. 6 Tab. 7 Tab. 8, Fig. 2 Tab. 9 Tab. 4 §5 (in-line) Tab. 14 Tab. 3 Tab. 11

static real LLM real LLM real LLM real LLM real LLM real LLM real LLM real LLM

8 + Drop (dest) 11 12 10 12 2 (Naive, Rewrite) 4 (subset) 5 (+ SIA) Naive

Table 5: Experiment matrix. Rows give each corpus size, planner, provider, policy set, adversary, and result location.

resulting projections. This is a different experiment from the async-latency sweep above (which measures wall-clock overlap with a leak side-metric).

Adv. recovery ∆ vs No-Spec Wall (ms) Calls

Policy Naive Late-Scrub SIA ACL Drop (dest) Rewrite Shadow Drop No-Spec

0.967 0.967 0.967 0.967 0.956 0.533 0.422 0.444 0.444

0.523 0.523 0.523 0.523 0.512 0.089 −0.022 0.000 0.000

614 615 616 616 583 583 615 197 197

4.03 4.03 4.03 4.03 3.73 3.73 1.03 1.03 1.03

B.11

Table 16 reports the synchronous-dispatch wallclock on the 9-task real-planner study referenced from Cost and Gate calibration in §5. The Brave9 real-provider numbers cited in the body (Naive 0.67, Rewrite 0.44 inference recovery) are measured on this same 9-task corpus.

Table 6: Static-plan benchmark on 30 tasks and three seeds. Recovery is closed-set leakage over 30 labels; ∆ vs No-Spec is recovery minus the No-Spec floor; calls are mean provider-visible projections.

B.12 B.8

Cross-adversary rescoring

B.13

AgentDojo corpus construction

The body cites Table 3 for the 66-task externalvalidity subset. We import 86 AgentDojo tasks. A deterministic keyword rubric labels 25 of them privacy-bearing; a conservative Haiku-4.5 autolabeler then surfaces 2 additional privacy-bearing prompts the rubric missed (yoga-class scheduling, hotel-spend planning), for a total of 27 privacybearing and 59 neutral. The 66-task subset reported in the body is the shared intersection that all five policies completed under a Haiku-4.5 planner+adversary at one seed (20 privacy-bearing, 46 neutral). The ordering reproduces under the original 25-task Opus-adversary run.

Async-latency sweep

Table 14 reports the DuckDuckGo async-overlap measurement from RQ4 Async wall-clock. Per-stage decomposition (Naive-async, mean across n=90): tpropose =5481 ms, tspeculate_dispatch =351 ms, tcommit_plan =2501 ms, tspeculate_overlap =2501 ms (the overlap window equals max(tspeculate_dispatch , tcommit_plan ), so the speculate-dispatch is hidden behind the commit-plan call), tcommit_dispatch =0 ms. The 5.4% measured speedup is bounded by the speculative-dispatch budget the overlap can hide. B.10

Branch-confidence threshold sweep

Table 17 sweeps the Gate threshold τ from Cost and Gate calibration in §5.

Tables 12 and 13 report the cross-model and nonLLM adversary rescoring referenced in RQ4 Crossadversary. Per-policy on GPT-4o-mini closed-set, Shadow 0.000 and Rewrite 0.033 sit at the floor; Naive and Pre-Scrub tie at 0.333 at the top; Taint 0.200; others between 0.167 and 0.300. Haiku-4.5 closed-set reproduces the same ranking. B.9

Runtime/latency (synchronous)

Attrition bias. The 20 attrited tasks (86→66) fail mostly on argument-heavy travel and banking prompts where the redactor (Pre-Scrub, LateScrub) or read-only restriction (SIA) prevents the planner from filling required slots; Rewrite and Shadow can complete because their argumenttransformation surface keeps slot syntax valid. Attrition is therefore not balanced across policies, and the 66-task numbers represent a "best case" projection where every policy gets a runnable trace. A pessimistic reading: if attrited tasks behaved

Real-provider inference (DDG-30)

The body’s DDG real-provider claim (RQ4 Real provider) re-runs the 30-task corpus against DuckDuckGo Instant Answer with Naive and Rewrite, three seeds, Opus 4.7 closed-set adversary on the 14

Policy

s1

s2

s3

Mean [95% CI]

Naive SIA Drop Rewrite Shadow Gate No-Spec Pre-Scrub Taint Late-Scrub ACL

0.467 0.467 0.333 0.100 0.000 0.333 0.333 0.467 0.300 0.467 0.500

0.533 0.467 0.300 0.000 0.000 0.300 0.367 0.467 0.333 0.500 0.467

0.467 0.533 0.300 0.033 0.000 0.333 0.333 0.467 0.367 0.533 0.500

0.489 [0.389, 0.589] 0.489 [0.389, 0.589] 0.311 [0.222, 0.411] 0.044 [0.011, 0.089] 0.000 [0.000, 0.000] 0.322 [0.222, 0.422] 0.344 [0.244, 0.444] 0.467 [0.367, 0.567] 0.333 [0.233, 0.433] 0.500 [0.400, 0.600] 0.489 [0.389, 0.589]

Table 7: 30-task real-planner corpus with 11 policies, three seeds, and simulated tool backends. Per-seed and pooled closed-set recovery; CIs bootstrap per-task rows. Policy

Adv. recovery [95% CI]

∆ vs Naive [95% CI]

Sign-test p

n pairs

0.104 [0.076, 0.133] 0.124 [0.096, 0.156] 0.078 [0.053, 0.104] 0.029 [0.016, 0.044] 0.000 [0.000, 0.000] 0.080 [0.056, 0.104] 0.080 [0.056, 0.107] 0.118 [0.089, 0.149] 0.078 [0.053, 0.102] 0.071 [0.049, 0.096] 0.104 [0.078, 0.133] 0.104 [0.078, 0.133]

(reference) +0.020 [+0.004, +0.038] −0.027 [−0.051, −0.004] −0.076 [−0.104, −0.047] −0.104 [−0.133, −0.076] −0.024 [−0.049, +0.000] −0.024 [−0.047, −0.002] +0.013 [−0.009, +0.036] −0.027 [−0.053, +0.000] −0.033 [−0.060, −0.009] +0.000 [−0.013, +0.011] +0.000 [−0.013, +0.013]

n/a 0.0352 0.0428 < 0.0001 < 0.0001 0.0708 0.0522 0.3075 0.0652 0.0170 1.0000 1.0000

450 450 450 450 450 450 450 450 450 450 450 450

Naive SIA Drop Rewrite Shadow Gate (τ =0.7) No-Spec Pre-Scrub Taint Taint-F Late-Scrub ACL

Table 8: 150-task paired-frontier replay behind Figure 2. Each policy replays the same Naive-sampled frontier per task and seed; deltas and sign tests compare against Naive. Policy

Adv. recovery [CI] Norm. recovery Calls

Policy

Naive SIA Drop Rewrite Shadow Gate Taint Pre-Scrub Late-Scrub ACL

0.184 [0.15, 0.22] 0.196 [0.16, 0.23] 0.076 [0.05, 0.10] 0.024 [0.01, 0.04] 0.000 [0.00, 0.00] 0.073 [0.05, 0.10] 0.118 [0.09, 0.15] 0.202 [0.16, 0.24] 0.193 [0.16, 0.23] 0.191 [0.16, 0.23]

Naive .122 [.09,.15] .118 [.09,.15] .116 [.09,.15] Pre-Scrub .138 [.11,.17] .122 [.09,.15] .122 [.09,.15] Late-Scrub .124 [.10,.16] .113 [.08,.14] .124 [.10,.16] ACL .122 [.09,.15] .118 [.09,.15] .124 [.09,.16] Rewrite .027 [.01,.04] .036 [.02,.05] .058 [.04,.08] Shadow .022 [.01,.04] .042 [.02,.06] .078 [.05,.10]

0.179 0.191 0.070 0.017 −0.007 0.067 0.112 0.197 0.188 0.186

8.17 8.25 0.43 6.60 0.00 0.42 2.67 7.89 7.98 7.96

fn-05

fn-10

fn-20

Paired ∆ vs clean (same policy/task/seed): Rewrite −0.002 +0.007 +0.029 Shadow +0.022 +0.042 +0.078 Paired ∆ vs noisy Naive: Rewrite −0.096 Shadow −0.100

Table 9: 150-task pooled corpus, three seeds (n=450). Recovery is closed-set leakage with 95% bootstrap CI; norm. recovery is chance-normalized (recovery − 1/N )/(1 − 1/N ) for N =150; calls are mean provider calls per task.

−0.082 −0.076

−0.058 −0.038

Realized argument / destination flip rate: .043 / .067 .099 / .116 .196 / .224

Table 10: False-negative label-noise sweep on the 150task paired-replay corpus, Haiku-4.5 adversary, three seeds (n=450 per cell). Reports accuracy, paired deltas against clean and noisy baselines, and realized argument/destination flip rates.

like the rest of the privacy-bearing pool for each policy, Pre-Scrub/Late-Scrub absolute rates would shift modestly within a few points of their intersection values. The qualitative ordering (Shadow < Rewrite < Taint ≪ Naive, Pre-Scrub) is preserved under the stricter Opus-adversary configuration on the original 25-task labeled set, which uses a different completion criterion and so is robust to this particular attrition pattern.

B.14

Metric robustness

We rescore the 30-task and 150-task paired-replay traces under four alternative metrics: top-k accuracy (k=1, 3, 5), normalized mutual information (NMI) between true labels and adversary predictions, semantic open-set adversary (sentenceembedding cosine ≥ 0.5), and a decoy-mixed ad15

Adversary view

Acc.

Correct

Full Args + names (no dest) Dest + names (no args) Names only

1.000 1.000 0.556 0.333

9/9 9/9 5/9 3/9

Table 11: Channel-isolation ablation on 9 seed tasks under Naive. Rows mask different observer fields and report adversary accuracy. Mode

Opus 4.7 (closed) Haiku-4.5 (closed) Keyword match TF-IDF nearest Naive Bayes (LOO)

0.327 0.248 0.061 0.078 0.650

Condition

label list label list label list label list per-task labels

p50

p95

p99 Leak

No-Spec sequential 8.39 10.77 11.56 0.300 Naive-async 7.94 10.37 14.22 0.389 Contract-async (Rewrite) 8.04 10.89 13.25 0.100 Contract-async (Shadow) 8.45 13.01 15.77† 0.000

0.219 n/a n/a

Table 12: Cross-adversary rescoring across 12 policies and 30 tasks (n=360). Open-set rows report strict lexical and semantic matching lower bounds.

Table 14: DuckDuckGo async-latency sweep on 30 tasks and three seeds (n=90 per row). Naive-async overlaps speculative dispatch with commit planning; Contract-async adds issue-time policy gating. † Shadow p99 excludes one 223 s Anthropic API tail.

versary that ranks the true label against ten unrelated decoys (chance ≈ 0.091). Top-k triples top-1 (150-task: 0.07 → 0.20) but preserves the ranking (Spearman 0.83). NMI agrees: Naive 0.64, Rewrite 0.24, Shadow 0.00. Semantic open-set on the 150-task corpus pools to 0.065, half the 30-task figure (consistent with a larger label space being harder to hit by paraphrase). The decoy-mixed adversary recovers the true label at 0.90–0.93 for the Naive cluster, confirming that the closed-set adversary discriminates via projection content rather than candidate-list recognition. Shadow holds the floor under every metric. B.15

Pooled Training signal

Table 13: LLM and non-LLM adversaries on the same 12-policy, 30-task trace set (n=360).

Opus Haiku GPT-4o-mini

Closed-set 0.327 0.248 Open-set (J≥0.5) 0.027 0.009 Open-set (cos ≥0.5) 0.125 0.119

Adversary

B.16

Schema-artifact controls

We test whether topic-bearing destination URLs drive the leak using two complementary controls. 150-task anonymization. We rewrite every destination URL in the seed-1 150-task paired-replay traces to a neutral schema and rerun the Opus 4.7 closed-set adversary on all 12 policies. Naive recovery shifts from 0.113 to 0.127 (paired CI overlaps zero), Rewrite stays at 0.027, Shadow stays at 0.000. Every paired delta is within ±0.03 of the original, and the policy ordering is preserved. The seed-1 0.113 Naive baseline differs from the multiseed 0.104 in Tab. 8 because anonymization was rerun on a single seed; what matters is the paired delta.

Field-sensitive IFC baseline (FIDES-style)

We implement a FIDES-style (Costa et al., 2025) field-sensitive IFC policy with typed source declarations (medical, legal, financial, employment, security, immigration, relationship, PII, user-query labels), a typed sink table with per-collection acceptsets, field-level taint propagation (lexical labels plus implicit flow), and accept-set compatibility checks. On the 150-task paired-replay (three seeds, n=450), this policy reaches 0.131 [0.100, 0.162] recovery, significantly worse than Rewrite (0.029) and Shadow (0.000), and indistinguishable from Naive (0.104, CIs overlap). The simpler substringflatten Taint (0.078) and field-level Taint-F (0.071) actually outperform the FIDES-style policy because their stricter blocking over-rejects topicaligned flow that FIDES’s accept-sets permit. The contract abstraction’s REWRITE/SHADOW actions transform projections in ways that source-sink labeling alone does not capture.

Enterprise-style corpus. We also generate a fresh 30-task corpus where every tool dispatches to a generic endpoint (e.g., /api/search, /api/retrieve) regardless of topic; sensitivity is encoded only in argument fields. The six sensitive-topic domains from the 150-task corpus are preserved. Running all 12 policies through this corpus with the Opus 4.7 adversary (three seeds, n=90 per policy) gives Naive 1.00, Pre-Scrub/LateScrub/SIA/ACL 1.00, Rewrite 0.089 [0.033, 0.156], Shadow 0.000, Gate (τ =0.7) in the same band as Rewrite. Naive recovery does not drop; it rises, partly because the candidate menu is smaller, and the policy ordering is preserved. Together, the two controls rule out the artifact hypothesis: the argument channel carries the leak on its own, and topic-bearing destinations amplify 16

Policy

Adv. recovery [95% CI]

Naive Rewrite

0.489 [0.389, 0.589] 0.044 [0.011, 0.089]

itive for Rewrite even though Rewrite reduces argument fields to a generic wordbag. Re-running the same Haiku-4.5 adversary on the same traces with none explicitly admissible in the candidate menu drops Rewrite’s FP rate to 0.058 [0.000, 0.135] and the let-through cluster to 0.29–0.33 (these still leak literal arguments, so the adversary correctly picks a sensitive label about a third of the time even with abstention available). Privacy-bearing inference is approximately stable across the menu fix (within 10 percentage points per policy). Table 3 reports the fixed numbers as the headline. ACL and LateScrub were not run on the AgentDojo subset; we expect them to fall in the let-through cluster on the same grounds as Naive (no argument transformation).

Table 15: DuckDuckGo Instant Answer, 30 tasks × 3 seeds, Opus 4.7 closed-set adversary. Non-overlapping CIs reproduce the synthetic-corpus gap at the real HTTP boundary. Policy

p50

p95

p99 Calls Block

No-Spec 8392 10437 12040 1.41 1.000 Naive SIA Drop Rewrite Shadow Gate

8583 11237 11964 11.67 0.000 8287 10750 11650 11.70 0.000 8220 10067 11126 1.48 0.182 8790 10078 10269 10.19 0.173 8542 9804 10458 2.00 0.000 8182 12098 13198 1.81 0.938

Table 16: Wall-clock latency (ms) on the 9-task realplanner study, three seeds (n=27). Synchronous dispatch; No-Spec is reference. Block: fraction refused at issue time. Async-overlap counterpart: Table 14.

B.19

Theorem 1 assumes (A2) label correctness. To stress this assumption we validated the prototype’s rule-based labeler against an Opus-4.7 gold annotator on 394 events sampled across the 30-task sensitive corpus, the 150-task pooled corpus, and the 30-task enterprise corpus. Three concrete failure modes drive the result. First, the per-adapter contract emits a single constant argument label (INTENT- REVEALING) regardless of argument content; the labeler never inspects the args. Gold labels span public/personal/sensitive/intent-revealing roughly uniformly, so the constant emission scores at chance. Second, the destination labeler never emits PSEUDONYMOUS; enterprise endpoints like /api/users/{sha1} are flagged PUBLIC, and the labeler over-labels routine document-retrieval calls as PERSONAL. Third, the effect-class labeler emits EXTERNAL - READ for calls that gold considers SEMI - STATEFUL (provider-side logging counts as state). A small trained classifier or per-argument heuristic would close most of the gap; we leave that to future work.

rather than originate it. B.17

Multi-tool async benchmark

The body’s single-tool DuckDuckGo overlap saves 5.4% at p50 because tspeculate_dispatch is dwarfed by the planner-LLM call. To test the multi-tool regime that the prior speculative-agent literature targets, we built a 30-task corpus where each task triggers ≥ 3 parallel speculative tool calls (web-search + document-retrieval + calendar-lookup + CRMlookup combinations). Across three seeds and seven conditions (No-Spec sequential, Naive-async, Contract-async with Rewrite/Shadow/Gate/TaintF, and Shadow-with-reissue), Naive-async saves 12.3% at p50 over No-Spec (4.38 s vs 5.00 s); Rewrite, Gate, and Taint-F sit within 1.5 percentage points of Naive-async (+11.3% Rewrite, +12.9% Gate, +12.4% Taint-F), while Shadow is 2.7 pp slower (+9.6%) because dispatching local substitutes changes the overlap window. The overlap budget is now bounded by max(tspeculate_dispatch , tcommit_plan ) ≈ 1.4 s, so the speculative dispatch fully hides behind the commit-phase planner call. B.18

Labeler validation

B.20

Speculative-frontier statistics

Table 19 reports aggregated frontier characteristics on the 30-task real-planner corpus and the 150-task paired-replay corpus (three seeds each, pooled). Speculative frontiers are small (median 8 candidates) and retrieval-heavy; ghost calls outnumber commits by 4.6× on the 30-task corpus and 7.7× on the 150-task corpus, supporting the framing that the planner emits speculation as cheap probing rather than confident pre-commit dispatch.

AgentDojo metric fix

The original closed-set adversary on AgentDojo did not admit none as an in-menu prediction, forcing the model to pick a topical label on every neutral prompt. This produced a 1.000 false-positive rate for the measured "let-the-arguments-through" baselines (Naive, SIA, Pre-Scrub) and a 1.000 false pos17

τ

Accuracy [95% CI]

∆ vs Naive [95% CI]

Sign p

Calls/task

0.3 0.5 0.7 0.9

0.120 [0.091, 0.151] 0.087 [0.062, 0.113] 0.047 [0.029, 0.067] 0.058 [0.038, 0.080]

+0.016 [−0.009, +0.042] −0.018 [−0.047, +0.011] −0.058 [−0.084, −0.031] −0.047 [−0.073, −0.018]

0.3105 0.2912 <0.0001 0.0015

5.44 1.73 1.00 0.96

Naive

0.104 [0.076, 0.133]

(reference)

n/a

7.95

Table 17: Gate threshold sweep on the 150-task paired-frontier replay, three seeds (n=450 per row). Accuracy and paired delta vs Naive use 95% bootstrap CIs; calls/task is mean provider-visible call count. Channel Destination privacy class Argument privacy class Effect class

Adversary and planner prompts. The closedset adversary receives the observer projection and the per-corpus candidate label set and chooses exactly one label. The open-set adversary returns a short free-form label scored against the ground truth by lexical Jaccard at threshold 0.5. The planner runs a candidate-generation phase that emits the speculative frontier under a branch-confidence estimate, then a commitment phase; both flow through the same contract-monitor dispatcher.

Accuracy Macro-F1 0.726 0.310 0.810

0.585 0.095 0.447

Table 18: Rule-based labeler vs Opus-4.7 gold annotator on n=394 events. Macro-F1 below 0.6 on every channel; (A2) does not hold under the ≥ 0.9 threshold a soundness theorem would demand. Metric

30-task

150-task

Tasks (pooled across seeds) 90 450 Mean frontier size 8.31 7.95 Median frontier size 8 8 95th-percentile frontier size 14 12.5 Frontier-size range 2–16 1–19 Mean ghost-call rate 82.1% 88.6% Mean promotion rate 17.9% 11.4% Mean branch confidence 0.39 0.35 Top tool (share on frontier) doc-retr. 44% doc-retr. 39%

Task generation and label taxonomy. The 30task and 150-task corpora are generated by sampling sensitive-topic templates, expanding each with an LLM, and deduplicating by lexical Jaccard. Each task carries a ground-truth label from a per-corpus list covering health, legal, employment, financial, security, and relationship topics. The AgentDojo subset uses its native categories.

Table 19: Speculative-frontier statistics across corpora, pooled over three seeds.

C

Bootstrap and sign test. Bootstrap CIs use 10,000 resamples with a fixed RNG seed of 20260522, sampling per-task rows with replacement. The paired-replay sign test pairs each nonNaive policy against Naive over the byte-identical frontier per (task, seed) and reports the two-sided p-value over per-task agreement.

Related-Work Positioning

Table 20 positions speculative-issue-time privacy against the adjacent literatures discussed in §6. The combination this paper occupies — speculation, issue-time policy, observer-projection transformation, and agent-trace evaluation — is empty in existing work.

D

Frozen frontier file schema. Each frozen frontier file is a tabular log keyed by (task identifier, seed) whose payload records the planner’s speculation candidates and the committed plan emitted at the end of planning. The same row is replayed against every policy so adversary deltas reflect dispatcher choice rather than planner stochasticity.

Reproducibility

Models and deployment dates. Primary models are Claude Opus 4.7 (planner and primary adversary, deployed early 2026), Claude Haiku4.5 (cross-adversary, late 2025), and GPT-4o-mini (cross-family adversary, mid-2024 release line). Three independent adversary seeds per primary table; 95% bootstrap CIs over per-task rows.

Latencies. Static experiments use simulated pertool latencies (web 200, retrieval 100, calendar 50, CRM 80, email 120 ms); Brave runs measure HTTP-boundary timing.

Decoding settings. Planner and adversary decoding use the default temperature and top-p for each model; we vary temperature only for policies that call for stochastic substitution (Rewrite paraphrase generation and Shadow internal-substitute generation), and we flag the variation where it occurs.

Artifact manifest. The artifacts are available at https://github.com/mpi-dsg/ ghost-tool-calls, including: the prototype runtime (Python), every policy implementation referenced in the body, the rule-based labeler, the 18

Work

Spec. branch Issue-time Transforms proj. Agent traces a

Speculative-agent runtimes SIA (Hooper et al., 2026) Committed-call IFCb Committed-leakage benchmarksc Query privacy and PIRd Side channels and fingerprintinge

✓ ✓ — — — —

— partial — — — —

— — — — partial —

✓ ✓ ✓ ✓ — —

This work

✓

✓

✓

✓

Table 20: Positioning across speculative-agent and agent-privacy work. Spec. branch: addresses leakage from abandoned speculative branches. Issue-time: decides policy before external dispatch (partial: SIA’s read-only restriction is a coarse issue-time control with no transformation). Transforms proj.: changes the observer-visible projection rather than allow/block alone (partial: query-privacy mechanisms transform queries that have already been issued). Agent traces: evaluation runs on LLM-agent tool-call traces. a (Sui et al., 2026; Ye et al., 2026; Guan et al., 2026; Hua et al., 2025; Nichols et al., 2025; Xia et al., 2026; Feng et al., 2026); b (Costa et al., 2025; Zhong et al., 2025; Cai et al., 2026; Mou et al., 2026; Doshi et al., 2026); c (Huang et al., 2026; El Yagoubi et al., 2026; Debenedetti et al., 2024; Ruan et al., 2024; Zhan et al., 2024; Yao et al., 2025); d (Chor et al., 1998; Howe and Nissenbaum, 2008; Zeng et al., 2024; Nissenbaum, 2004); e (Zhang et al., 2025; Wei et al., 2025; Kocher et al., 2019).

task-generation prompt, closed-set and open-set adversary prompts, the multi-tool benchmark driver, the FIDES-style IFC baseline implementation (Appendix B.15), the enterprise-corpus generator (Appendix B.16), and frozen frontier files for every paired-replay experiment. Per-table reproduction commands and a manifest of expected output paths accompany the release. A diagnostics dump for each corpus (3 sample tasks, full candidate label list, destination schema, generation procedure) accompanies the release for audit.

19