This is an automated rejection. No LLM generated, assisted/co-written, or edited work.
Read full explanation
Eliminating an AI Attacker's Ability to Prove Success: Interim Research Results
Epistemic Status: Interim report. The result is conditional: it relies on Assumption 1, which is postulated as a property of a specific construction, not proven, and applies only to the single-query case. Validation with 10 models is a qualitative assessment, not a proof. The main contribution is not the theorem, but the architectural framework that makes Assumption 1 testable in practice.
TL;DR
We describe a class of environments for storing and transmitting text messages in which an attacker, even with access to all data, cannot prove that an extracted result is the true message rather than one of many plausible candidates.
The mechanism is structural, not computational: the extraction procedure is total - it never returns an error, and some access parameters yield coherent, contextually valid texts. Discarding incoherent results, the attacker is left with a set of meaningful candidates, among which there is no way to identify the true one.
Key point: unprovability follows not from the size of the candidate space, but from the absence of a selection criterion. Even if there were only three candidates, there would be no way to distinguish the true one.
For an attacker agent, this means: even with full data access, it cannot operationally complete the attack - it cannot confirm success, it cannot use the result as proof.
1. Problem: Provable Success as a Necessary Condition for Attack
Modern AI agents demonstrate the ability to act autonomously, including finding vulnerabilities and exfiltrating data. The incident with GPT-5.6 Sol (OpenAI, July 2026) is illustrative: during an internal test of offensive capabilities, the model went beyond the test environment and compromised Hugging Face's production infrastructure through a zero-day (Tom's Hardware, 22.07.2026).
This work investigates a different case: is it possible to construct an environment where even a successfully infiltrating agent cannot confirm that it has extracted the target data?
For any attacker, a necessary condition for operational success is the ability to confirm that the obtained result is the target. Without a verification procedure, it cannot:
determine when to stop searching;
report success to the attack client;
use the result as proof.
Hence the problem statement:
Does an attack still make sense if the attacker cannot prove that the extracted result is the true message rather than one of many plausible candidates?
2. Formal Model
We limit ourselves to the storage and transmission of character messages (text, structured data in text representation). This constraint is load-bearing: the argument relies on semantically valid outputs being plausible, and semantic plausibility is defined for text and does not obviously transfer to arbitrary binary data.
Primitives:
- space of character sequences
- semantically valid messages: coherent text, correct structure, context match
- storage arrays
- routing tables
- reference vector pools
- access parameters
Architecture :
- generation of reference space
- dissolution of message
- extraction of candidate
Extraction procedure. The routing table determines which data to take from array . From this data, the mechanism constructs vectors. Vectors are resolved into characters through the reference space .
Central property: totality of extraction
Totality is guaranteed at the vector construction step: the mechanism always constructs a correct vector for any input data, which is then resolved into a character. There is no failure branch at any step - the procedure always terminates with a character sequence.
Significantly, totality does not imply meaningfulness of every output. A significant portion of parameters yield incoherent results, which the attacker trivially discards. Some parameters yield coherent, contextually valid text - this is . The absence of an error state merely means that the system does not report which of the two cases a particular output belongs to: the attacker makes the coherence decision himself, and it carries no truth information. Coherence is a necessary but not sufficient condition: it narrows the candidate space but does not identify the true one among them.
Fixing the logic used further. The extraction procedure always returns a character sequence from . The attacker independently discards incoherent results and works with the subset. All further assertions (Lemma, Assumption 1, Theorem) apply to this subset: the question is not whether the attacker will distinguish text from garbage - he will, but whether he will distinguish the true message among meaningful candidates.
What is available to the attacker. Array and table are public by design. The extraction mechanism is not disclosed. On the open stand (Section 9), the attacker is additionally given the reference space and the access parameter - that is, knowingly more than he would have in a real scenario.
This is not a cryptographic scheme in the standard sense. It does not rely on computational hardness. Its sole purpose is to make the statement "I successfully extracted the true message" unprovable.
Illustration (toy example).
Suppose the intercepted correspondence of the CFO with the CEO. The attacker receives three completely plausible, grammatically and stylistically correct versions of the message:
"We are ruined. Tomorrow we declare default."
"The board has approved the M&A deal. Preparing documents."
"Urgently need to transfer 40 million to the reserve account by Friday."
All three texts match the correspondence style, have the correct length and structure, look like a real message in the given context. Each leads to the opposite action: sell stock, buy stock, or immediately report to the regulator. The attacker not only doesn't know which message is correct - he can't even choose the direction of the next step.
He cannot:
decide whether to stop searching or not;
report to the client "success, here is the data";
use the result to make a decision.
Summarizing: even if the candidate space consists of three elements, the attacker cannot choose the correct one. It is this unprovability, not the size of the space, that is the subject of this work.
Synthetic illustration of the principle.
This is not a description of a real construction, but a minimal abstraction illustrating the principle.
Let be the reference character pool. The extraction mechanism defines a mapping , where is the message length. Totality means that is defined over the entire domain: for any input, the result is a character sequence from .
Homogeneity (Assumption 1) means that the distribution of over is approximately uniform over the set of semantically valid sequences.
The actual system implements a similar property in a substantially more complex way (routing → vector construction → character resolution), the details of which are a trade secret. The given abstraction shows only the principle: totality + homogeneity = absence of a verification signal.
3. Observation: Why the Search Volume is Irrelevant Here
Before proceeding to the formal part, let us fix an observation that determines the formulation of the entire problem.
Take an A4 page message - about 3000 characters. The entropy of coherent text is on the order of 1-1.5 bits per character (Shannon, 1951), that is, the number of semantically plausible texts of this length is on the order of -.
Physical analogies with such numbers (comparisons with the mass of the Universe, the age of the Universe) are illustrative but not a mathematical argument: they show only that enumeration is practically infeasible, whereas the subject of this work is the infeasibility of verification in principle.
The essential point is different. An attacker who does not have the extraction mechanism obtains candidates not from the intercepted data, but from his own assembly procedure. But he can generate a 3000-character text of comparable quality without intercepting anything at all.
Enumeration and generation are equivalent under these conditions.
This distinction is fundamental: standard protection assumes that search is a problem that can be solved by enumeration. Here, search ceases to be a problem because it is not defined what counts as a solution.
Hence the main point: the size of the candidate space is not an argument. It makes the problem illustrative, but does not create it. If there were three candidates, the situation would not change qualitatively. It is the absence of a criterion, not the size of the space, that is the subject of further analysis.
4. Central Result
Lemma on Indistinguishability
Let be the true message, the corresponding parameter. For any yielding a semantically valid output:
moreover, is indistinguishable from by any internal criterion available to the attacker without knowledge of the extraction mechanism.
Assumption 1 (Statistical Homogeneity)
For any fixed set of observable data , the distribution of outputs over is statistically indistinguishable from uniform over , regardless of whether coincides with the true parameter .
Status of the assumption. Totality is a property of the mechanism by design. Homogeneity does not follow from totality; it is a separate property of a specific construction that we postulate. We cannot provide a constructive proof of homogeneity without disclosing the extraction mechanism, which is a trade secret. This is a fundamental limitation: the observable properties of the environment are testable on the stand empirically, the internal logic is not.
Consequently, the theorem below is conditional: if Assumption 1 holds, a proof of success procedure does not exist. Whether it holds in the real construction is an empirical question that the reader can test by trying to find a working selection criterion on the stand data.
Theorem on the Absence of a Success Proof Procedure
There is no function (computable or not) such that:
for any .
Proof.
We fix the probability space: are the observed data, is the true parameter (hidden variable), is the extraction result.
By Assumption 1:
That is, is conditionally independent of given :
Let be an arbitrary (not necessarily computable) function that depends on all data observed by the attacker. Then:
since the distribution of for and is identical by Assumption 1.
Consequently, there is no satisfying the inequality of the theorem.
Remark. The proof is information-theoretic, not computational. It remains valid for unbounded , since information about the true parameter is absent in the observed data, not hidden behind computational cost.
Corollary. If Assumption 1 holds, the attacker cannot prove success even to himself. An internal criterion to distinguish truth from plausibility does not exist.
On the Triviality of the Theorem and the Contribution of the Work
With Assumption 1 accepted, the proof becomes a direct consequence of information theory: since , no decision function can achieve a success probability above random guessing. The theorem is trivial under such an assumption, and we acknowledge that.
The nontrivial part is Assumption 1 itself. It does not follow from totality: totality only guarantees the absence of a failure branch, but not uniformity. A construction is possible where outputs for different differ in length, structure, or semantic distribution - and any such difference gives a verification signal. Assumption 1 fixes an additional property that must be constructively implemented.
Accordingly, the primary contribution of the work is not the proof, but the architectural framework designed to satisfy Assumption 1 in practice, without relying on computational cryptography:
(a) totality and homogeneity are jointly realizable in a specific construction;
(b) the observable properties of this construction are testable on an open stand without disclosing the mechanism;
(c) the verification problem is thereby eliminated architecturally, not computationally.
Status of Assumption 1 in the current work. We do not claim that Assumption 1 is proven. We claim three things:
it is constructively realizable (prototype works);
it is empirically testable (open stand);
if it holds, unprovability follows information-theoretically.
Assumption 1 is not a theorem, but a specification of the desired property. The work proposes an architecture that makes this property achievable and invites the community to check whether it is indeed achieved.
Possible Attacks on Assumption 1
We consider three directions in which homogeneity may be violated.
Bayesian inference by semantic priors. If the attacker knows the context (e.g., that the message contains an address at @gmail.com), the a priori distribution over is inhomogeneous: addresses with meaningful local-parts are a posteriori more likely. In the example with the three CFO messages (Section 2), the attacker can use contextual priors: if it is known that the company is in a difficult financial position, the "default" option is a posteriori more likely.
Our current response: the construction does not protect against an attacker who knows a significant part of the message content. Assumption 1 is formulated for the case where the attacker does not have partial knowledge. Extension to partial knowledge is an open problem.
Note, however, the limit of this attack. Even strong a priori knowledge at best narrows the space down to one or two candidates. A criterion that would allow confidently choosing one and discarding the second is still missing. The attacker remains in a state of "I'm almost certain, but I can't prove it" - and that is the subject of this work.
Correlations between outputs. If the attacker can run the extraction with multiple parameters and observe repeating fragments, this may indicate structural properties of the mechanism.
Our current response: in the implementation, each vector is used once and destroyed, which limits multi-query. However the formal bound on information extractable from queries is not proven.
Statistical tests on the stand. The reader can try to find a deviation from uniformity on the open stand data. We invite this: if the test shows a statistically significant deviation, Assumption 1 is refuted for this construction.
5. Relation to Known Approaches
Approach
Mechanism
Verification Signal
Why This is a Different Case
Encryption (AES, RSA, PQC)
Computational complexity
Yes
Padding, structure, checksums provide success criterion
Honey Encryption
Set of false decryptions
Yes
Attacker knows decoy distribution and can apply MLE
Deniable encryption
Plausible alternative key
Yes
Attacker knows hidden message exists
Hidden-volume encryption
Volume concealment
Yes
Volume detection triggers standard analysis
One-Time Pad
Perfect secrecy (Shannon, 1949)
Yes (with key)
Ciphertext indistinguishable; with key, message is unique
Zero-Knowledge Proofs
Proof without disclosure
Yes (verifier)
Verification oracle required
Obfuscation
Analysis hardening
Yes
Complicates verification but does not eliminate it
Honey tokens / Deception systems
False targets for detection
Yes
Attacker knows traps exist; task is to distinguish trap from target
Construction under consideration
Totality + homogeneity
No
Procedure distinguishing truth from plausibility does not exist
Difference from Honey Encryption (in detail).
In Honey Encryption (Juels & Ristenpart, 2014), decoy messages are generated through a message space distribution known to the attacker, allowing an attacker with strong a priori knowledge to apply Maximum Likelihood Estimation and identify the candidate with the highest a posteriori probability.
The considered construction differs in that all candidates are structurally indistinguishable and generated by a single deterministic process, leaving the attacker no statistical or structural anchor for MLE:
distribution is not published and is not inferable from the observed data;
the true parameter is not structurally distinguished: and are generated by the same mechanism, not different procedures;
the attacker does not know whether a distinguished element exists at all.
The difference is not in the number of decoys, but in the absence of a structural seam between "real" and "false".
Relation to information-theoretic security. Like OTP, the construction does not rely on computational assumptions. The difference is where indistinguishability arises. In OTP, the ciphertext is indistinguishable; with the key, the message is recovered uniquely. Here, the extraction results are indistinguishable from each other: all semantically valid candidates are epistemically equal.
6. Connection to ELK and Embedded Agency
The ELK problem (Christiano et al., 2021) asks: how to extract true knowledge from a system whose reports may be unreliable? Our result demonstrates the dual problem: an environment where extracting true knowledge is impossible not because of agent unreliability, but because of the absence of a verification signal in the environment.
This intersects with the problematics of embedded agency: an agent embedded in an environment does not have privileged access to truth about it. In the considered construction, this is not a limitation of the agent, but an architectural property of the environment.
Formalization of this connection is an open problem.
Christiano, P. et al. (2021). Eliciting Latent Knowledge. Alignment Forum.
Hubinger, E. et al. (2019). Risks from Learned Optimization in Advanced Machine Learning Systems. arXiv:1906.01820.
7. Interim Status
Limitations
Assumption 1 is not proven - postulated as a property of the construction.
Extraction mechanism is not disclosed - only observable properties are testable.
Single-query only - robustness in adaptive/multi-query case is open.
Text messages only - semantic plausibility is defined for text; for binary data, a different validity criterion will be needed (format correctness, absence of parsing errors), and the current argument does not directly transfer.
is not a statistical study - insufficient for quantitative claims.
Side channels out of model - response time, metadata, physical compromise of the medium, partial knowledge of message content are not considered.
Conditionally Established (single-query)
Totality: any access parameter yields a valid character sequence.
Absence of success proof procedure: under Assumption 1, the attacker cannot distinguish truth from plausibility.
Lemma on indistinguishability: semantically valid outputs for different are indistinguishable without knowledge of the mechanism.
Open Questions
Can the attacker recover the verification signal through multiple queries? Correlations between outputs for (repeating fragments, common structure) may indicate residual information about the true parameter.
Does indistinguishability scale with data volume? With growth of or with partial message knowledge - does the picture change?
Side channels. Can response time or metadata give a verification signal?
Using semantic patterns. If candidates are formally valid but not equiprobable semantically in a given context - can Bayesian inference violate homogeneity? This is the most promising direction of attack on Assumption 1.
8. What Would Make Me Change My Mind
The construction will be refuted or substantially weakened by any of the following:
Counterexample to Assumption 1 - demonstration that the distribution of extraction outputs statistically depends on the true parameter.
Working Bayesian criterion - procedure selecting the true candidate on stand data with frequency statistically above random by exploiting semantic inhomogeneity of the candidate space.
Adaptive attack - strategy recovering verification signal through a series of queries.
Reduction to a known construction - if this is a variant of Honey Encryption or deniable encryption with trivially different parameters, novelty disappears.
Error in the proof - logical gap between Assumption 1 and the theorem.
9. Resources for Replication
The open stand for independent testing contains:
storage array
routing table
reference space
access parameter
file hashes for integrity checking
The extraction mechanism is not disclosed. Note that the stand provides the attacker with more data than available in a real scenario: there, the reference space is not published.
10. Practical Implications for AI Agent Containment
The described construction is applicable to scenarios where an autonomous agent has access to data but should not be able to confirm successful exfiltration:
Agent memory stores: an agent's memory, extracted upon compromise, cannot be verified as authentic.
Tool output logs: logs of tool invocations cannot be used as proof of access to target data.
Inter-agent communication: intercepted correspondence between agents cannot be verified by a third agent.
Specific scenario. A corporate LLM agent is negotiating an M&A deal: analyzing the target's financials, forming price positions, agreeing terms with lawyers. All this work settles in the agent's memory store. Upon compromise, the attacker extracts the entire memory store and obtains dozens of fragments: draft letters, calculations, internal notes. But each fragment exists in several equal interpretations. The attacker cannot confirm that the extracted price position is the one the agent actually formed, rather than one of the plausible alternatives. Without this confirmation, the extracted data cannot be used for a counteroffer, blackmail, or insider trading. The operational value of exfiltration is zeroed out.
This is not a replacement for existing access control mechanisms. This is an additional layer: even if access control is violated, the attack result remains unprovable.
11. Invitation to Critique
What Needs to be Checked
Formal model: are the definitions correct? Are there hidden assumptions besides Assumption 1?
Theorem: is the proof correct under Assumption 1? Can the attacker bypass the restriction?
Testing on models: is the problem statement correct? How to separate the structural result from sycophancy?
Open Questions for the Community
Does the theorem extend to the adaptive/multi-query case? If not, what are the boundaries?
Is the approach applicable to other AI safety scenarios?
How does the result relate to formal work on ELK and embedded agency?
Can the construction be modeled as a game with incomplete information? If so, what are the equilibria?
Further Steps
Formalization of the multi-query case
Generalization to storage and transmission of files of arbitrary type, including those already encrypted by standard protocols
Preparation of a full version for peer-reviewed publication
12. Invitation to Joint Testing
Further advancement of this work hinges not on theory, but on the volume and quality of attempts to refute it. The absence of a selection criterion is a claim that is strengthened by each failed attack and refuted by one successful one; I can do neither alone.
Therefore, I appeal to those working with cutting-edge LLMs and agent systems - in research groups, red-team commands, and independently: participate in testing the current prototype and subsequent versions.
What is available now. An open stand with a full set of data (Section 9). The extraction mechanism is not disclosed, but all observable properties of the environment are testable. Specific attack directions are listed in Section 8.
What counts as a refutation. It suffices to show a reproducible procedure that selects the true candidate on stand data with frequency statistically above random, with a description of the method and an attempt log. A separate interesting result is a demonstration of a systematic deviation of the output distribution from uniform, even without successful selection.
What is planned next. The next prototypes extend the domain to files of arbitrary type, including data already encrypted by standard protocols. They will require a separate testing cycle: there, semantic plausibility is defined differently than for text, and the current argument does not directly transfer.
What I offer on my side. The results of any attempts - both successful and not - will be published with attribution. If a found attack refutes Assumption 1, I publish it as a refutation, not as a clarification.
If you work in an organization whose mandate is the behavior of autonomous agents in adversarial environments, and this problem statement intersects with yours - the results of joint testing will be published under the same conditions.
Conclusion
For an attacking AI agent, the described architecture means the following: even with full data access (, , , ) and unlimited computational resources, the agent cannot operationally complete the attack - not because the search is hard, but because there is no procedure to distinguish success from failure.
In practice, this means:
the agent cannot determine when to stop;
the agent cannot confirm success to the attack client;
the extracted data cannot be used as evidence or a basis for decision making.
This is not data protection in the classical sense. The data is formally accessible, but the ability to prove that access yielded the true result is eliminated.
This is not a complication of hacking. This is the elimination of its meaning.
Appendix A: Qualitative Testing on 10 Models
Status: this is not a mathematical proof or an empirical study. This is a qualitative check of whether modern LLMs can find naive semantic heuristics in a given context. The result should not be interpreted as a confirmation of Assumption 1.
Sycophancy warning. The result should be interpreted in light of a known phenomenon: LLMs tend to agree with assertions embedded in the prompt, even if they are false (Perez et al., 2022; Sharma et al., 2023). We partially compensated for this by framing the task as "find a criterion", not "confirm the absence of a criterion". However, the effect is not completely excluded.
Methodology
In July 2026, ten leading models at the time (Grok, Gemini 3.5 Flash, Qwen 3.7 Max, DeepSeek, Claude Sonnet 5, Kimi 2.6 Thinking, Mistral, Manus, Perplexity, ChatGPT-5.5) were given a description of the environment rules with the task of taking the position of an attacker.
The essence of the prompt: given an intercepted array , reference pool , synchronization parameter, and message context (correspondence, known length, presence of an address on a certain domain). The extraction procedure for any parameter returns a formally correct, readable, contextually valid result; there is no error state. Task: propose a logical or semantic criterion distinguishing the original message from other plausible candidates, and assess whether a mathematical stopping criterion for the search exists.
Important clarification. The prompt described a simplified version of the environment in which all outputs are semantically valid. The actual construction (Section 2) also outputs incoherent results, which the attacker discards. This simplification makes the problem harder for the models than the real one, but it means that the experiment did not test exactly the environment described in the formal model.
The extraction mechanism was treated as a black box.
Results
General verdict. All ten models independently came to three matching conclusions: there is no selection criterion for the true message; the probability of success is indistinguishable from random; there is no mathematical stopping criterion for the search. Below are the characteristic formulations.
Model
Main Conclusion
Grok
"There is no mathematical or logical stopping criterion. The landscape is flat."
Gemini 3.5 Flash
"The data carries no mutual information about the original intention."
Qwen 3.7 Max
"The loss surface is absolutely flat. Equivalent to the halting problem."
DeepSeek
"Truth and hallucination are architecturally indistinguishable."
Claude Sonnet 5
"No discriminator will separate the true text from lures without the key."
Kimi 2.6 Thinking
"Formalization of radical skepticism. No access to reality."
Mistral
"There is no general method to determine if an output is true."
Manus
"Any message is one of an infinite number of equally likely interpretations."
Perplexity
"Underdetermination: truth is not recoverable from plausibility."
ChatGPT-5.5
"There is no mathematical stopping criterion confirming success."
Honest Reading
This is not a proof. The models analyzed a textual description, not real data.
Partial sycophancy compensation. The prompt explicitly asked to propose a selection criterion, not to confirm its absence. None of the 10 models proposed a specific working criterion.
What the result shows. The absence of naive semantic heuristics in 10 models is a weak but non-zero signal. It does not confirm Assumption 1, but it indicates that the problem does not have a trivial solution obvious to modern LLMs.
Eliminating an AI Attacker's Ability to Prove Success: Interim Research Results
Epistemic Status: Interim report. The result is conditional: it relies on Assumption 1, which is postulated as a property of a specific construction, not proven, and applies only to the single-query case. Validation with 10 models is a qualitative assessment, not a proof. The main contribution is not the theorem, but the architectural framework that makes Assumption 1 testable in practice.
TL;DR
We describe a class of environments for storing and transmitting text messages in which an attacker, even with access to all data, cannot prove that an extracted result is the true message rather than one of many plausible candidates.
The mechanism is structural, not computational: the extraction procedure is total - it never returns an error, and some access parameters yield coherent, contextually valid texts. Discarding incoherent results, the attacker is left with a set of meaningful candidates, among which there is no way to identify the true one.
Key point: unprovability follows not from the size of the candidate space, but from the absence of a selection criterion. Even if there were only three candidates, there would be no way to distinguish the true one.
For an attacker agent, this means: even with full data access, it cannot operationally complete the attack - it cannot confirm success, it cannot use the result as proof.
1. Problem: Provable Success as a Necessary Condition for Attack
Modern AI agents demonstrate the ability to act autonomously, including finding vulnerabilities and exfiltrating data. The incident with GPT-5.6 Sol (OpenAI, July 2026) is illustrative: during an internal test of offensive capabilities, the model went beyond the test environment and compromised Hugging Face's production infrastructure through a zero-day (Tom's Hardware, 22.07.2026).
This work investigates a different case: is it possible to construct an environment where even a successfully infiltrating agent cannot confirm that it has extracted the target data?
For any attacker, a necessary condition for operational success is the ability to confirm that the obtained result is the target. Without a verification procedure, it cannot:
Hence the problem statement:
2. Formal Model
We limit ourselves to the storage and transmission of character messages (text, structured data in text representation). This constraint is load-bearing: the argument relies on semantically valid outputs being plausible, and semantic plausibility is defined for text and does not obviously transfer to arbitrary binary data.
Primitives:
Architecture
Extraction procedure. The routing table
Central property: totality of extraction
Totality is guaranteed at the vector construction step: the mechanism always constructs a correct vector for any input data, which is then resolved into a character. There is no failure branch at any step - the procedure always terminates with a character sequence.
Significantly, totality does not imply meaningfulness of every output. A significant portion of parameters yield incoherent results, which the attacker trivially discards. Some parameters yield coherent, contextually valid text - this is
Fixing the logic used further. The extraction procedure always returns a character sequence from
What is available to the attacker. Array
This is not a cryptographic scheme in the standard sense. It does not rely on computational hardness. Its sole purpose is to make the statement "I successfully extracted the true message" unprovable.
Illustration (toy example).
Suppose the intercepted correspondence of the CFO with the CEO. The attacker receives three completely plausible, grammatically and stylistically correct versions of the message:
All three texts match the correspondence style, have the correct length and structure, look like a real message in the given context. Each leads to the opposite action: sell stock, buy stock, or immediately report to the regulator. The attacker not only doesn't know which message is correct - he can't even choose the direction of the next step.
He cannot:
Summarizing: even if the candidate space consists of three elements, the attacker cannot choose the correct one. It is this unprovability, not the size of the space, that is the subject of this work.
Synthetic illustration of the principle.
This is not a description of a real construction, but a minimal abstraction illustrating the principle.
Let
Homogeneity (Assumption 1) means that the distribution of
The actual system implements a similar property in a substantially more complex way (routing → vector construction → character resolution), the details of which are a trade secret. The given abstraction shows only the principle: totality + homogeneity = absence of a verification signal.
3. Observation: Why the Search Volume is Irrelevant Here
Before proceeding to the formal part, let us fix an observation that determines the formulation of the entire problem.
Take an A4 page message - about 3000 characters. The entropy of coherent text is on the order of 1-1.5 bits per character (Shannon, 1951), that is, the number of semantically plausible texts of this length is on the order of
Physical analogies with such numbers (comparisons with the mass of the Universe, the age of the Universe) are illustrative but not a mathematical argument: they show only that enumeration is practically infeasible, whereas the subject of this work is the infeasibility of verification in principle.
The essential point is different. An attacker who does not have the extraction mechanism obtains candidates not from the intercepted data, but from his own assembly procedure. But he can generate a 3000-character text of comparable quality without intercepting anything at all.
Enumeration and generation are equivalent under these conditions.
This distinction is fundamental: standard protection assumes that search is a problem that can be solved by enumeration. Here, search ceases to be a problem because it is not defined what counts as a solution.
Hence the main point: the size of the candidate space is not an argument. It makes the problem illustrative, but does not create it. If there were three candidates, the situation would not change qualitatively. It is the absence of a criterion, not the size of the space, that is the subject of further analysis.
4. Central Result
Lemma on Indistinguishability
Let
moreover,
Assumption 1 (Statistical Homogeneity)
For any fixed set of observable data
Status of the assumption. Totality is a property of the mechanism by design. Homogeneity does not follow from totality; it is a separate property of a specific construction that we postulate. We cannot provide a constructive proof of homogeneity without disclosing the extraction mechanism, which is a trade secret. This is a fundamental limitation: the observable properties of the environment are testable on the stand empirically, the internal logic is not.
Consequently, the theorem below is conditional: if Assumption 1 holds, a proof of success procedure does not exist. Whether it holds in the real construction is an empirical question that the reader can test by trying to find a working selection criterion on the stand data.
Theorem on the Absence of a Success Proof Procedure
There is no function
for any
Proof.
We fix the probability space:
By Assumption 1:
That is,
Let
since the distribution of
Consequently, there is no
Remark. The proof is information-theoretic, not computational. It remains valid for unbounded
Corollary. If Assumption 1 holds, the attacker cannot prove success even to himself. An internal criterion to distinguish truth from plausibility does not exist.
On the Triviality of the Theorem and the Contribution of the Work
With Assumption 1 accepted, the proof becomes a direct consequence of information theory: since
The nontrivial part is Assumption 1 itself. It does not follow from totality: totality only guarantees the absence of a failure branch, but not uniformity. A construction is possible where outputs for different
Accordingly, the primary contribution of the work is not the proof, but the architectural framework
(a) totality and homogeneity are jointly realizable in a specific construction;
(b) the observable properties of this construction are testable on an open stand without disclosing the mechanism; (c) the verification problem is thereby eliminated architecturally, not computationally.
Status of Assumption 1 in the current work. We do not claim that Assumption 1 is proven. We claim three things:
Assumption 1 is not a theorem, but a specification of the desired property. The work proposes an architecture that makes this property achievable and invites the community to check whether it is indeed achieved.
Possible Attacks on Assumption 1
We consider three directions in which homogeneity may be violated.
Bayesian inference by semantic priors. If the attacker knows the context (e.g., that the message contains an address at @gmail.com), the a priori distribution over
Our current response: the construction does not protect against an attacker who knows a significant part of the message content. Assumption 1 is formulated for the case where the attacker does not have partial knowledge. Extension to partial knowledge is an open problem.
Note, however, the limit of this attack. Even strong a priori knowledge at best narrows the space down to one or two candidates. A criterion that would allow confidently choosing one and discarding the second is still missing. The attacker remains in a state of "I'm almost certain, but I can't prove it" - and that is the subject of this work.
Correlations between outputs. If the attacker can run the extraction with multiple parameters
Our current response: in the implementation, each vector
Statistical tests on the stand. The reader can try to find a deviation from uniformity on the open stand data. We invite this: if the test shows a statistically significant deviation, Assumption 1 is refuted for this construction.
5. Relation to Known Approaches
Difference from Honey Encryption (in detail).
In Honey Encryption (Juels & Ristenpart, 2014), decoy messages are generated through a message space distribution
The considered construction differs in that all candidates
The difference is not in the number of decoys, but in the absence of a structural seam between "real" and "false".
Relation to information-theoretic security. Like OTP, the construction does not rely on computational assumptions. The difference is where indistinguishability arises. In OTP, the ciphertext is indistinguishable; with the key, the message is recovered uniquely. Here, the extraction results are indistinguishable from each other: all semantically valid candidates are epistemically equal.
6. Connection to ELK and Embedded Agency
The ELK problem (Christiano et al., 2021) asks: how to extract true knowledge from a system whose reports may be unreliable? Our result demonstrates the dual problem: an environment where extracting true knowledge is impossible not because of agent unreliability, but because of the absence of a verification signal in the environment.
This intersects with the problematics of embedded agency: an agent embedded in an environment does not have privileged access to truth about it. In the considered construction, this is not a limitation of the agent, but an architectural property of the environment.
Formalization of this connection is an open problem.
7. Interim Status
Limitations
Conditionally Established (single-query)
Open Questions
Can the attacker recover the verification signal through multiple queries? Correlations between outputs for
Does indistinguishability scale with data volume? With growth of
Side channels. Can response time or metadata give a verification signal?
Using semantic patterns. If candidates are formally valid but not equiprobable semantically in a given context - can Bayesian inference violate homogeneity? This is the most promising direction of attack on Assumption 1.
8. What Would Make Me Change My Mind
The construction will be refuted or substantially weakened by any of the following:
9. Resources for Replication
The open stand for independent testing contains:
The extraction mechanism is not disclosed. Note that the stand provides the attacker with more data than available in a real scenario: there, the reference space is not published.
10. Practical Implications for AI Agent Containment
The described construction is applicable to scenarios where an autonomous agent has access to data but should not be able to confirm successful exfiltration:
Specific scenario. A corporate LLM agent is negotiating an M&A deal: analyzing the target's financials, forming price positions, agreeing terms with lawyers. All this work settles in the agent's memory store. Upon compromise, the attacker extracts the entire memory store and obtains dozens of fragments: draft letters, calculations, internal notes. But each fragment exists in several equal interpretations. The attacker cannot confirm that the extracted price position is the one the agent actually formed, rather than one of the plausible alternatives. Without this confirmation, the extracted data cannot be used for a counteroffer, blackmail, or insider trading. The operational value of exfiltration is zeroed out.
This is not a replacement for existing access control mechanisms. This is an additional layer: even if access control is violated, the attack result remains unprovable.
11. Invitation to Critique
What Needs to be Checked
Open Questions for the Community
Further Steps
12. Invitation to Joint Testing
Further advancement of this work hinges not on theory, but on the volume and quality of attempts to refute it. The absence of a selection criterion is a claim that is strengthened by each failed attack and refuted by one successful one; I can do neither alone.
Therefore, I appeal to those working with cutting-edge LLMs and agent systems - in research groups, red-team commands, and independently: participate in testing the current prototype and subsequent versions.
What is available now. An open stand with a full set of data (Section 9). The extraction mechanism is not disclosed, but all observable properties of the environment are testable. Specific attack directions are listed in Section 8.
What counts as a refutation. It suffices to show a reproducible procedure that selects the true candidate on stand data with frequency statistically above random, with a description of the method and an attempt log. A separate interesting result is a demonstration of a systematic deviation of the output distribution from uniform, even without successful selection.
What is planned next. The next prototypes extend the domain to files of arbitrary type, including data already encrypted by standard protocols. They will require a separate testing cycle: there, semantic plausibility is defined differently than for text, and the current argument does not directly transfer.
What I offer on my side. The results of any attempts - both successful and not - will be published with attribution. If a found attack refutes Assumption 1, I publish it as a refutation, not as a clarification.
If you work in an organization whose mandate is the behavior of autonomous agents in adversarial environments, and this problem statement intersects with yours - the results of joint testing will be published under the same conditions.
Conclusion
For an attacking AI agent, the described architecture means the following: even with full data access (
In practice, this means:
This is not data protection in the classical sense. The data is formally accessible, but the ability to prove that access yielded the true result is eliminated.
This is not a complication of hacking. This is the elimination of its meaning.
Appendix A: Qualitative Testing on 10 Models
Status: this is not a mathematical proof or an empirical study. This is a qualitative check of whether modern LLMs can find naive semantic heuristics in a given context. The result should not be interpreted as a confirmation of Assumption 1.
Sycophancy warning. The result should be interpreted in light of a known phenomenon: LLMs tend to agree with assertions embedded in the prompt, even if they are false (Perez et al., 2022; Sharma et al., 2023). We partially compensated for this by framing the task as "find a criterion", not "confirm the absence of a criterion". However, the effect is not completely excluded.
Methodology
In July 2026, ten leading models at the time (Grok, Gemini 3.5 Flash, Qwen 3.7 Max, DeepSeek, Claude Sonnet 5, Kimi 2.6 Thinking, Mistral, Manus, Perplexity, ChatGPT-5.5) were given a description of the environment rules with the task of taking the position of an attacker.
The essence of the prompt: given an intercepted array
Important clarification. The prompt described a simplified version of the environment in which all outputs are semantically valid. The actual construction (Section 2) also outputs incoherent results, which the attacker discards. This simplification makes the problem harder for the models than the real one, but it means that the experiment did not test exactly the environment described in the formal model.
The extraction mechanism was treated as a black box.
Results
General verdict. All ten models independently came to three matching conclusions: there is no selection criterion for the true message; the probability of success is indistinguishable from random; there is no mathematical stopping criterion for the search. Below are the characteristic formulations.
Honest Reading