{"id":"https://openalex.org/W7160951596","doi":"https://doi.org/10.48550/arxiv.2605.10614","title":"PRISM: Generation-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines","display_name":"PRISM: Generation-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines","publication_year":2026,"publication_date":"2026-05-11","ids":{"openalex":"https://openalex.org/W7160951596","doi":"https://doi.org/10.48550/arxiv.2605.10614"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.10614","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.10614","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.10614","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5123536679","display_name":"Riya Tapwal","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tapwal, Riya","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135990456","display_name":"Abhishek Kumar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kumar, Abhishek","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135961655","display_name":"Carsten Maple","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Maple, Carsten","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.38179999589920044,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.38179999589920044,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.241799995303154,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.08940000087022781,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/information-leakage","display_name":"Information leakage","score":0.5577999949455261},{"id":"https://openalex.org/keywords/leakage","display_name":"Leakage (economics)","score":0.5411999821662903},{"id":"https://openalex.org/keywords/decoding-methods","display_name":"Decoding methods","score":0.3978999853134155},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.3723999857902527},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.3718999922275543},{"id":"https://openalex.org/keywords/leak","display_name":"Leak","score":0.3531999886035919},{"id":"https://openalex.org/keywords/pipeline-transport","display_name":"Pipeline transport","score":0.35190001130104065}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6897000074386597},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.5577999949455261},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.5411999821662903},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.47200000286102295},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.41830000281333923},{"id":"https://openalex.org/C57273362","wikidata":"https://www.wikidata.org/wiki/Q576722","display_name":"Decoding methods","level":2,"score":0.3978999853134155},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.3723999857902527},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.3718999922275543},{"id":"https://openalex.org/C2780378346","wikidata":"https://www.wikidata.org/wiki/Q1349983","display_name":"Leak","level":2,"score":0.3531999886035919},{"id":"https://openalex.org/C175309249","wikidata":"https://www.wikidata.org/wiki/Q725864","display_name":"Pipeline transport","level":2,"score":0.35190001130104065},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.33640000224113464},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3280999958515167},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3116999864578247},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28859999775886536},{"id":"https://openalex.org/C98083399","wikidata":"https://www.wikidata.org/wiki/Q3246517","display_name":"Underwater","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.2800999879837036},{"id":"https://openalex.org/C2776788033","wikidata":"https://www.wikidata.org/wiki/Q320769","display_name":"Eavesdropping","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C2776207758","wikidata":"https://www.wikidata.org/wiki/Q5303302","display_name":"Downstream (manufacturing)","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C136536468","wikidata":"https://www.wikidata.org/wiki/Q1225894","display_name":"Undersampling","level":2,"score":0.25940001010894775}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.10614","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.10614","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.10614","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.10614","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.5861025452613831}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Multi-agent":[0],"LLM":[1],"systems":[2],"introduce":[3],"a":[4,97,105,129,154,187,193,206,255],"security":[5],"risk":[6,39,107,131,141],"in":[7,22,157,205],"which":[8,249],"sensitive":[9,45],"information":[10],"accessed":[11],"by":[12,153,161],"one":[13],"agent":[14,42],"can":[15],"propagate":[16],"through":[17,136],"shared":[18],"context":[19],"and":[20,61,125,139,164,201,219,235],"reappear":[21],"downstream":[23,51],"outputs,":[24],"even":[25],"without":[26,84],"explicit":[27],"adversarial":[28,195],"intent.":[29],"We":[30],"formalise":[31],"this":[32,68],"phenomenon":[33],"as":[34,44,104,174],"propagation":[35],"amplification,":[36],"where":[37],"leakage":[38,103,185,227],"increases":[40],"across":[41],"boundaries":[43],"content":[46],"is":[47,146,150,189],"repeatedly":[48],"exposed":[49],"to":[50],"generators.":[52],"Existing":[53],"defences,":[54],"including":[55],"prompt-based":[56],"safeguards,":[57],"static":[58],"pattern":[59],"matching,":[60],"LLM-as-judge":[62],"filtering,":[63],"are":[64],"not":[65],"designed":[66],"for":[67],"setting:":[69],"they":[70],"either":[71],"operate":[72],"after":[73],"generation,":[74],"rely":[75],"primarily":[76],"on":[77,228],"surface-form":[78],"patterns,":[79],"or":[80],"add":[81],"substantial":[82],"latency":[83],"modelling":[85],"the":[86,244],"generation":[87,158],"process":[88],"itself.":[89],"To":[90],"resolve":[91],"these":[92,177],"issues,":[93],"we":[94],"propose":[95],"PRISM,":[96],"real-time":[98],"defence":[99],"that":[100,147],"treats":[101],"credential":[102,148],"sequential":[106],"accumulation":[108],"problem":[109],"during":[110],"generation.":[111],"At":[112],"each":[113],"decoding":[114],"step,":[115],"PRISM":[116,210],"combines":[117],"16":[118],"signals":[119,179],"spanning":[120],"lexical,":[121],"structural,":[122],"information-theoretic,":[123],"behavioural,":[124],"contextual":[126],"features":[127],"into":[128],"calibrated":[130],"score,":[132],"enabling":[133],"per-token":[134],"intervention":[135],"green,":[137],"yellow,":[138],"red":[140],"zones.":[142],"Our":[143],"central":[144],"observation":[145],"reproduction":[149],"often":[151],"preceded":[152],"measurable":[155],"shift":[156],"dynamics,":[159],"characterised":[160],"entropy":[162],"collapse":[163],"increasing":[165],"logit":[166],"concentration.":[167],"When":[168],"combined":[169],"with":[170,215,254],"text-structural":[171],"cues":[172],"such":[173],"identifier-pattern":[175],"detection,":[176],"temporal":[178],"provide":[180],"an":[181],"early":[182],"warning":[183],"of":[184,239],"before":[186],"secret":[188],"fully":[190],"reconstructed.":[191],"Across":[192],"2,000-task":[194],"benchmark":[196,230],"covering":[197],"13":[198],"attack":[199],"categories":[200],"three":[202],"pressure":[203],"levels":[204],"heterogeneous":[207],"four-agent":[208],"pipeline,":[209],"achieves":[211,250],"F1":[212,251],"=":[213,217,221,252],"0.832":[214],"precision":[216],"1.000":[218],"recall":[220],"0.712,":[222],"while":[223],"producing":[224],"no":[225],"observed":[226],"our":[229],"(0.0%":[231],"task-level":[232,257],"leak":[233,258],"rate)":[234],"preserving":[236],"output":[237],"utility":[238],"0.893.":[240],"It":[241],"substantially":[242],"outperforms":[243],"strongest":[245],"baseline,":[246],"Span":[247],"Tagger,":[248],"0.719":[253],"15.0%":[256],"rate.":[259]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-13T00:00:00"}