Authorization Before Context: Preventing Cross-Audience Memory Leakage in Agentic Systems

Overview

Agentic systems, particularly personal language agents, risk memory leakage where information learned in one audience context is inadvertently or maliciously exposed to another. This issue stems from the memory-to-context step, identified as an attack surface susceptible to ambiguous or inconsistent channels, cross-audience prying, and poisoned memory. These vulnerabilities can lead to the system assembling context that contains facts relevant to a query but unauthorized for the current viewers. To address this, a mechanism termed authorization before context has been introduced. This mechanism operates as a single, anti-monotone audience-membership rule applied during the transition of information from memory to context. It aims to establish a model-neutral invariant on the exact assembled context, ensuring that a forbidden fact must be absent before the model is called.

Research Context

The core problem addressed is the potential for cross-audience memory leakage within agentic systems, specifically personal language agents. These systems learn facts in the context of one audience and subsequently integrate these facts into prompts assembled for other audiences. The process of transferring information from memory into the assembled context for a language agent is pinpointed as a critical vulnerability point. Specific threats identified include situations arising from ambiguous or inconsistent channels, active cross-audience prying, and the integrity compromise of stored information through poisoned memory. Each of these can contribute to the generation of context that inadvertently includes facts unauthorized for the current set of viewers requesting information.

Approach

The proposed solution, authorization before context, centers on an anti-monotone audience-membership rule applied at the memory-to-context transition. This rule relies on several defined components and processes:

• Each memory item is tagged with the audience present when it was recorded.
• The current viewer set is dynamically determined by reading channel metadata. In instances where this metadata is ambiguous, the viewer set falls back to public.
• An item from memory is only admitted into the assembled context if every current viewer already belonged to its audience.

This rule defines a clear boundary mechanism. It guarantees that the inclusion of information into the context is conditioned on a strict audience overlap criterion. The approach is characterized as model-neutral because the exclusion of unauthorized facts occurs by exclusion rather than by model behavior, meaning the control is external to the language model's operational logic.

Findings

The application of the authorization before context rule yielded several outcomes, which were formally established and empirically observed:

• **Cross-Channel Recall:** The rule is proven to enable every participant cross-channel recall. This implies that authorized users maintain access to relevant information across different channels without restrictions imposed by the authorization boundary.
• **Prevention of Broader Audience Access:** The mechanism ensures that nothing recorded for a a narrower audience reaches a broader one. This is a direct consequence of the admission rule requiring all current viewers to have been part of the original recording audience.
• **Defense Against Poisoned Memory:** It ensures that poisoned memory cannot widen its own audience. This indicates a robustness against attempts to manipulate access controls by altering the audience attribution of stored data.
• **Model-Neutral Invariant:** The boundary creates a model-neutral invariant on the exact assembled context, which translates to the assurance that a forbidden fact must be absent before the model is called. The integrity of the context is secured prior to any processing by the agentic system.
• **Synthetic Evaluation:** On a synthetic Contextual-Integrity suite, empirical testing showed that no forbidden fact entered the context our boundary assembled. This contrasts with unscoped baselines, which included such facts by construction, confirming the effectiveness of the boundary.
• **Fail-Closed Read Paths:** An audit confirmed that every read path fails closed, indicating a secure default posture where access is denied if authorization cannot be explicitly confirmed.

Key Limitations Mentioned by Researchers

The evidence supporting the effectiveness of authorization before context is described as preliminary and synthetic. This indicates that the current evaluation has been conducted in controlled, simulated environments and suggests that further, potentially more diverse, validation is required to fully assess its real-world applicability and robustness.