Information-flow control: open-access research

Journal article

A Trust Score Needs a Consumer: Four Places a Per-Source Trust Value Can Act on an LLM Agent, the Missing Test of a Graded Discount Against an Adaptive Attacker, and Why the Defences That Report Guarantees Use a Gate Instead of a Score

Pranay Mahendrakar 2026

Work on trust between language-model agents produces two kinds of object. Protocol work produces identity, attestation, stake and constraint, all bound at the transport layer before any content reaches a model. Behavioural work produces a per-source score: a reputation, a credibility, a…

Cite Related research LOR-00068 · 10 views · 19 downloads

PDF470.2 KB

Journal article

A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks

Pranay Mahendrakar 2026

Two lines of work on language-model agents have converged on the same component from opposite directions. One proposes that an agent keep a persistent safety memory, so that an attack seen once, a request refused once or a source found untrustworthy once continues to inform decisions in later…

Cite Related research LOR-00061 · 7 views · 6 downloads

PDF479.5 KB

Journal article

A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks

Pranay Mahendrakar 2026

Two lines of work on language-model agents have converged on the same component from opposite directions. One proposes that an agent keep a persistent safety memory, so that an attack seen once, a request refused once or a source found untrustworthy once continues to inform decisions in later…

Cite Related research LOR-00003 · 7 views · 30 downloads

PDF476.5 KB

Journal article

Near-Zero Until Someone Tries: What a Prompt-Injection Defense Number Measures, Why Static and Adaptive Results Do Not Reconcile, and the Assumption the Out-of-Band Turn Has Not Yet Tested

Pranay M. Mahendrakar 2026

Several published prompt-injection defenses report attack success rates at or near one percent on static benchmarks; published adaptive attacks report success above fifty percent against the same defense families, and above ninety percent in several instances. Neither set of numbers is a…

Cite Related research LOR-00040 · 6 views · 6 downloads

PDF484.5 KB

Journal article

Intent Is Not a Property of the Record: Agent Memory Contamination, the Two Detector Families That Cover Disjoint Failures, and the Base Rate Nobody Has Measured

Pranay M. Mahendrakar 2026

Persistent agent memory has acquired a security literature that models contamination as adversarial injection, and detectors are trained and evaluated on attacker-generated distributions. A separate empirical literature reports the same downstream damage with no attacker present, when an agent…

Cite Related research LOR-00044 · 8 views · 26 downloads

PDF461.3 KB

5 records

A Trust Score Needs a Consumer: Four Places a Per-Source Trust Value Can Act on an LLM Agent, the Missing Test of a Graded Discount Against an Adaptive Attacker, and Why the Defences That Report Guarantees Use a Gate Instead of a Score

A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks

A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks

Near-Zero Until Someone Tries: What a Prompt-Injection Defense Number Measures, Why Static and Adaptive Results Do Not Reconcile, and the Assumption the Out-of-Band Turn Has Not Yet Tested

Intent Is Not a Property of the Record: Agent Memory Contamination, the Two Detector Families That Cover Disjoint Failures, and the Base Rate Nobody Has Measured