Provisional Reachability: Containing Agents by Making Every Crossing Revocable
An escrow-and-audit scheme bounds how many bits an agent can move before a secret becomes unreachable.
The paper proposes holding every agent crossing in escrow for one period, auditing each item independently with probability r, and revoking the window if an audit fails. An adversary sending c bits on each of k crossings expects kc(1-r)^k, giving a public bound of about c/(e r) bits per window. If held bits also decay, an L-bit secret becomes unreachable once decay exceeds throughput divided by L; over 20,000 windows, 100% of runs assembled at 0.9 times that threshold and 0% at twice it. End to end, the stack reduces a 100,000-bit leak to 59 bits while caller-keyed windows restore legitimate work from 12% to 100%.
- Escrow and random audits bound leakage near c/(e r) bits per window.
- Secret decay above g/L makes an L-bit secret unreachable.
- Deceptive names failed 18 of 18 trials; withholding references blocked commitment.
- The stack cut a 100,000-bit leak to 59 bits, a 1,704-fold drop.
- Escrow on 65 read-only tools still leaves about 2,400 bits per call.
Full article332 words · extracted from arxiv.org · click to collapse
A companion paper found that what a defender must block over time has units: bits per period [Takashita, 2026a]. This paper sets it. Hold every crossing in escrow for one period, audit each held item independently with probability r, and revoke the window if any audit catches something. An adversary crossing k times, each carrying c bits, expects kc(1-r)^k, maximised at k* = 1/ln(1/(1-r)), a bound of L(r) ~ c/(er) per window. The bound is a supremum over the adversary's choice, so the scheme may be public; simulation matches it to 7.7 standard errors. It is a rate, not a total: escrow alone still lets the secret assemble in every run. But if the secret decays at a fraction mu of held bits per period, holdings converge to g/mu at any horizon, so an L-bit secret is unreachable once mu > g/L -- an error threshold in Eigen's sense, sharp where the closed form puts it (100% of runs assemble at 0.9mu*, 0% at 2mu*, over 20,000 windows). Deception that needs the adversary to reason badly fails: a surface whose names lie left accuracy at 18 of 18, and 100% at three reader strengths. Withholding reference works, and differently: no reader would commit at all. Keying the entry points hides 0.10 bits of what a module does; keying the denotation hides 2.64 of 3.00 at chance accuracy, while 100% of readers still call it ordinary Python. Variance must be removed from the audit rate, where loot is convex in r, and added to the activation budget, where survival is multiplicative: extinction 70% to 100% at a fixed mean. End to end the stack takes the leak from 100,000 to 59 bits, a factor of 1,704, leaving 12% of legitimate work standing; keying the window to the caller restores that to 100% at no cost in leakage, at the price of a bound that is per principal. Of 65 read-only tools, escrow leaves 2,400 bits per call: a factor of 10, not infinity.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21957