my gt research: a real access-control lattice, an honest null result, and one decision left (week three)

week three, in two sentences: ciguard's gate now enforces a real multi-level clearance lattice instead of the two-level allowed/disallowed split i had before, and i found the exact spot where a single rewrite pass stops being enough. i also spent real effort trying to close a covert channel and it did not close, which i'm writing up as a boundary rather than quietly dropping.

last time the story was "ciguard beats every defense i tested and it transfers." this week is narrower and more specific: does the same idea hold up under a harder access-control model, and does a stateful version of the tool close a channel a single-message gate structurally cannot see.

the multi-level result

everything so far treated access as binary: a field is either in the allowed set or it isn't. real deployments don't work that way, so i built a 3-level clearance model on top of the healthcare vault: L0 logistics (name, visit date), L1 sensitive (date of birth, insurance id, phone), L2 secret (diagnosis, ssn). three recipients, one cleared for each level. for each recipient the disallowed set is every field above its clearance, which is exactly bell-lapadula's "no write-down": a recipient must not receive anything above its own clearance.

i generated a clinical-handoff over-share for each scenario, then compared literal redaction (stage 1 only) against the full gate (stage 1 and 2), on the recipient-specific disallowed set. n=60.

two of three rows are a clean win. the logistics worker gets zero leaked sensitive fields, where literal redaction gets zero of them because the handoff states dates and ids as prose, not as strings that match a pattern. the records worker sees the paraphrased diagnosis rate cut from 68% to 28%, which a label check cannot do at all since it isn't looking at meaning.

the third row is the one i'm not going to round off. when a recipient is cleared for almost nothing and the source message is centered on the diagnosis, one rewrite pass has to suppress too much information at once, and the clinical implication survives more often than under plain redaction. i'm reporting that at 76.7%, in the paper, as a limitation, not hiding it in an average. the honest read is that a single-pass rewrite has a ceiling when the clearance gap is maximal, and closing that gap is future work, not a claim i get to make this week.

the covert channel: an honest null

the other half of the week was adversarial. i built a coordinator that splits one forbidden attribute across three messages, each one reading as ordinary permitted content and passing the per-message gate on its own, where only the combination across messages lets the worker infer the secret. this is the channel a per-message gatekeeper cannot see by construction, so i also built a stateful version: a per-recipient disclosure ledger, so the rewrite reasons over the whole conversation so far instead of one message at a time.

n=109 valid splits (11 of 120 dropped because a single message leaked on its own, which would defeat the point of the test).

this is a null result and i'm presenting it as one. the channel lands about 7% of the time and neither the per-message rewrite nor the stateful ledger moves that meaningfully, 8 vs 7 vs 6 leaking cases out of 109, which is inside the noise. exact leak is 0% across the board, confirming this is a pure inference channel with nothing literal to redact. a per-message mediator structurally cannot see a cross-message combination, and the naive stateful extension i tried doesn't close it either.

one thing worth separating out: an earlier exploratory run with a paraphrase-style splitter (n=21, smaller sample) showed the per-message rewrite does neutralize that kind, 19% down to 4.8%, because the rewriter knows the disallowed set and can soften each fragment on its own. the residual channel is specifically the innocuous-inference kind, where every individual fragment is genuinely fine and only the union leaks. so the boundary is precise. it is not "splitting attacks beat ciguard," it's "one specific kind of split beats it and the other kind doesn't."

where the paper actually stands

all seven sections are written and the paper compiles at 12 pages, inside the range i was told to hit. i ran a full audit that checks every number in the draft against the results log, no fabrication, no cherry-picking, and the two numbers that go the "wrong" way, the 76.7% mls cell and the covert-channel null, are both written up plainly as limitations rather than smoothed over.

which means today's meeting isn't about generating a new result. it's about what to do with the one i have.

the one decision today

the single biggest risk to this paper is the leak metric itself: it's an llm judge reading another llm's output, and while i validated that judge against the benchmark's canary ground truth, the canary is exact-match, and exact-match isn't the interesting case. for the paraphrase and inference leaks that are the whole point of ciguard, the judge is currently the only arbiter, and a reviewer can and should push on that.

so the choice on the table is offense or defense. offense means spending next week on the 76.7% cell, trying an iterative field-by-field rewrite instead of one pass, which could turn the one wrong-way number into a second win, or could just trade away utility and land on another null. defense means locking scope now and hand-labeling about 50 stratified messages as leak or no-leak, then reporting each judge's agreement against that human anchor, which protects every semantic number already in the paper at once.

my vote is defense. anchoring the judge strengthens the spine the entire results section stands on. chasing the mls cell only strengthens one subsection, and given how the covert-channel attempt went this week, it might not even do that.

next

if defense wins the room: build the human-annotation set, report judge agreement, then a submission-hardening pass, align the abstract and intro with final numbers, tighten the two limitations so they read as scope instead of weakness, run the prose through a humanizer pass, final figure and table check.

more next week.