Agents can be contained by revoking every crossing they make
Provisional Reachability: Containing Agents by Making Every Crossing Revocable
Cryptography and SecurityNetworking and Internet Architecture
Summary
This paper studies how to stop agents from secretly gathering information by making every attempt to cross a boundary reversible. The authors propose holding each crossing event for a short time and auditing it with some chance of catching wrongdoing. They find formulas that limit how much secret can get through and show that if secrets naturally decay over time, total leakage can be prevented. Their method balances security with allowing legitimate work to continue, and they test it through simulations and auditing techniques.
What this means in practice
- •For security engineers: Contain unauthorized data exfiltration by revoking suspicious crossing events with probabilistic audits to limit secret leakage over time.
- •For software developers: Use escrow and revocation techniques for sensitive function calls to reduce secret exposure while preserving legitimate functionality.
Authors
Yoshiaki Takashita
Abstract
A companion paper found that what a defender must block over time has units: bits per period [Takashita, 2026a]. This paper sets it. Hold every crossing in escrow for one period, audit each held item independently with probability r, and revoke the window if any audit catches something. An adversary crossing k times, each carrying c bits, expects kc(1-r)^k, maximised at k* = 1/ln(1/(1-r)), a bound of L(r) ~ c/(er) per window. The bound is a supremum over the adversary's choice, so the scheme may be public; simulation matches it to 7.7 standard errors. It is a rate, not a total: escrow alone still lets the secret assemble in every run. But if the secret decays at a fraction mu of held bits per period, holdings converge to g/mu at any horizon, so an L-bit secret is unreachable once mu > g/L -- an error threshold in Eigen's sense, sharp where the closed form puts it (100% of runs assemble at 0.9mu*, 0% at 2mu*, over 20,000 windows). Deception that needs the adversary to reason badly fails: a surface whose names lie left accuracy at 18 of 18, and 100% at three reader strengths. Withholding reference works, and differently: no reader would commit at all. Keying the entry points hides 0.10 bits of what a module does; keying the denotation hides 2.64 of 3.00 at chance accuracy, while 100% of readers still call it ordinary Python. Variance must be removed from the audit rate, where loot is convex in r, and added to the activation budget, where survival is multiplicative: extinction 70% to 100% at a fixed mean. End to end the stack takes the leak from 100,000 to 59 bits, a factor of 1,704, leaving 12% of legitimate work standing; keying the window to the caller restores that to 100% at no cost in leakage, at the price of a bound that is per principal. Of 65 read-only tools, escrow leaves 2,400 bits per call: a factor of 10, not infinity.