Both papers
The Sealed Harbor
Mutually confidential computation with every information release explicit, gated, and bounded — four independently verified pillars, and an honestly priced leakage budget.
The big idea, in one paragraph.
Derek owns sensitive data. Erin owns a valuable model. Both want one answer computed from both, and neither will hand over the crown jewels — nor will the cloud operator hosting the job get to read either. The tempting pitch is a "silicon-enforced NDA": tag anything the model reads and refuse to let a tainted byte leave. This chapter explains why that sentence must never ship: an LLM taints everything it writes with everything it read, so a token-level tracker is either useless or unsound. The honest fix controls the channel, not the token — a work order signed by both parties, a room sealed by dual-attested key release, two fences around the worker, and exactly two declassification gates. What still crosses those gates is not zero; it is metered, and this chapter prices the meter.
Words this paper uses, defined.
Skim these once. The rest of the page assumes them, and the PDF leans on them harder.
- Clean room
- The confidential-VM job Derek and Erin jointly authorize: an ephemeral key, an attested runtime, semantic-handle-only access for the worker, and exactly three pre-authorized exits (a rich result to Derek, bounded feedback to Erin, a padded receipt to both).
- Declassification gate
- The one place a label may be removed from tainted state, under a declared release function each principal agreed to in the work order. The theorem says the gate is the only opening; it does not say the declared function releases too little.
- Whole-worker taint
- After the first secret read, the entire worker — not just the bytes it touched — is treated as tainted until job destruction. The sound over-approximation once token-level taint is granted to be undefinable for a generative model.
- Leakage budget
- The chapter's headline number: a malicious worker that launders its output through an honest gate can move at most b bits per job through a b-bit release channel, or q times b bits across q jobs — an arithmetic ceiling a contract can quote, bond, and police.
- Canary
- A planted, secret span that turns "we think nothing leaked" into a quoted detection probability and an expected time-to-alarm, the same way a dye pack turns a bank robbery into a stain.
What this gives you.
You should leave able to (a) explain why "tag it and drop tainted output" is not a security architecture for a tool-using agent, and what narrower claim replaces it; (b) name the four pillars and which single question each one closes (where can the boundary be, does it hold, what does it cost, what evades it); and (c) read a leakage-budget number off a work order the way you would read an interest rate — q jobs times a b-bit channel, before timing.
How to use this.
If you are building a service that runs someone else's agent against your data, or your model against someone else's data, this chapter is the checklist: seal the compute, hand the worker handles instead of plaintext, put exactly one gate on every exit, meter what the gate releases as a conserved budget, and plant canaries so an evasion attempt has a quoted cost instead of an unbounded one.
Open in tab