{"id":"https://openalex.org/W7165643593","doi":"https://doi.org/10.48550/arxiv.2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","display_name":"GIF: Locally Sound Geometric Information Flow Control for LLMs","publication_year":2026,"publication_date":"2026-06-22","ids":{"openalex":"https://openalex.org/W7165643593","doi":"https://doi.org/10.48550/arxiv.2606.23277"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.23277","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.23277","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.23277","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139134797","display_name":"Adam Storek","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Storek, Adam","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139187997","display_name":"Nikolaus Holzer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Holzer, Nikolaus","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139145904","display_name":"Zhuo Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Zhuo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139140031","display_name":"Suman Jana","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jana, Suman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5306000113487244,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5306000113487244,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.2231999933719635,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.04320000112056732,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.8087000250816345},{"id":"https://openalex.org/keywords/information-flow","display_name":"Information flow","score":0.5920000076293945},{"id":"https://openalex.org/keywords/downstream","display_name":"Downstream (manufacturing)","score":0.487199991941452},{"id":"https://openalex.org/keywords/mutual-information","display_name":"Mutual information","score":0.47749999165534973},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.4399000108242035},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.3662000000476837},{"id":"https://openalex.org/keywords/information-sensitivity","display_name":"Information sensitivity","score":0.36039999127388},{"id":"https://openalex.org/keywords/flow","display_name":"Flow (mathematics)","score":0.3513999879360199},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.3427000045776367}],"concepts":[{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.8087000250816345},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7089999914169312},{"id":"https://openalex.org/C2779136372","wikidata":"https://www.wikidata.org/wiki/Q10283002","display_name":"Information flow","level":2,"score":0.5920000076293945},{"id":"https://openalex.org/C2776207758","wikidata":"https://www.wikidata.org/wiki/Q5303302","display_name":"Downstream (manufacturing)","level":2,"score":0.487199991941452},{"id":"https://openalex.org/C152139883","wikidata":"https://www.wikidata.org/wiki/Q252973","display_name":"Mutual information","level":2,"score":0.47749999165534973},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.4399000108242035},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3765999972820282},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3662000000476837},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.36039999127388},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3578000068664551},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3522999882698059},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.3513999879360199},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.3427000045776367},{"id":"https://openalex.org/C118930307","wikidata":"https://www.wikidata.org/wiki/Q600590","display_name":"Tuple","level":2,"score":0.33660000562667847},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.31790000200271606},{"id":"https://openalex.org/C2780069185","wikidata":"https://www.wikidata.org/wiki/Q7977945","display_name":"Equivalence (formal languages)","level":2,"score":0.311599999666214},{"id":"https://openalex.org/C52622258","wikidata":"https://www.wikidata.org/wiki/Q131222","display_name":"Information theory","level":2,"score":0.3102000057697296},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.29409998655319214},{"id":"https://openalex.org/C2776452267","wikidata":"https://www.wikidata.org/wiki/Q1503443","display_name":"Secrecy","level":2,"score":0.28999999165534973},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.28279998898506165},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.2809000015258789},{"id":"https://openalex.org/C2776788033","wikidata":"https://www.wikidata.org/wiki/Q320769","display_name":"Eavesdropping","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C163629137","wikidata":"https://www.wikidata.org/wiki/Q1276903","display_name":"Siphon (mollusc)","level":2,"score":0.2775999903678894},{"id":"https://openalex.org/C87868495","wikidata":"https://www.wikidata.org/wiki/Q750843","display_name":"Information processing","level":2,"score":0.27300000190734863},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.26170000433921814},{"id":"https://openalex.org/C200331156","wikidata":"https://www.wikidata.org/wiki/Q506041","display_name":"Jacobian matrix and determinant","level":2,"score":0.25589999556541443},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2558000087738037},{"id":"https://openalex.org/C177774035","wikidata":"https://www.wikidata.org/wiki/Q1246948","display_name":"Granularity","level":2,"score":0.2535000145435333}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.23277","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.23277","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.23277","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.23277","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.769114077091217,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,130,233,238],"increasingly":[3],"mediate":[4],"interactions":[5],"between":[6,116],"sensitive":[7],"data,":[8],"untrusted":[9],"inputs,":[10],"and":[11,19,106,120,134,148,178,184,239],"privileged":[12],"actions":[13],"in":[14,72],"agentic":[15],"systems,":[16],"creating":[17],"security":[18],"privacy":[20],"risks.":[21],"These":[22],"range":[23],"from":[24,79,96],"prompt":[25,168],"injections":[26],"that":[27,157],"manipulate":[28],"downstream":[29,194],"tool":[30],"use":[31],"to":[32,99,110,222,235,249],"leakage":[33],"of":[34,210],"confidential":[35],"information":[36,57,94,115,162],"through":[37,59],"model":[38,61,121,241],"outputs.":[39,100],"Recent":[40],"Information":[41,86],"Flow":[42,87],"Control":[43],"(IFC)-based":[44],"defenses":[45],"show":[46],"promise":[47],"but":[48],"lack":[49],"a":[50,89,124,151,166,193],"principled":[51],"semantic":[52,90],"foundation":[53],"for":[54,92],"reasoning":[55,218],"about":[56],"flow":[58,95,163],"the":[60,103,112,160,208,245],"itself.":[62],"Since":[63],"any":[64,69],"input":[65,97,118],"token":[66,71,225],"may":[67],"influence":[68],"output":[70,108],"an":[73],"autoregressive":[74],"LLM,":[75],"existing":[76],"approaches":[77],"suffer":[78],"severe":[80],"taint":[81],"explosion.":[82],"We":[83,173],"present":[84],"Geometric":[85],"(GIF),":[88],"framework":[91],"tracking":[93],"tokens":[98],"GIF":[101,143,175,187,227],"uses":[102],"LLM":[104],"Jacobian":[105],"local":[107,145,170],"geometry":[109],"upper-bound":[111],"Shannon":[113],"mutual":[114],"perturbed":[117],"spans":[119],"outputs,":[122],"yielding":[123],"scalable":[125],"measure":[126],"computable":[127],"on":[128,176],"large":[129],"via":[131],"automatic":[132],"differentiation":[133],"low-rank":[135],"approximation.":[136],"Unlike":[137],"attention-based":[138,197],"or":[139,206],"correlational":[140],"attribution":[141],"heuristics,":[142],"satisfies":[144],"geometric":[146],"soundness,":[147],"we":[149],"provide":[150],"fully":[152],"mechanized":[153],"Lean":[154],"4":[155],"proof":[156],"it":[158,204],"upper-bounds":[159],"true":[161],"induced":[164],"by":[165],"given":[167],"under":[169],"regularity":[171],"assumptions.":[172],"evaluate":[174],"integrity":[177],"confidentiality":[179],"tasks":[180],"across":[181],"multiple":[182],"prompt-injection":[183],"privacy-leakage":[185],"benchmarks.":[186],"achieves":[188],"near-perfect":[189],"recall":[190],"even":[191,243],"without":[192,255],"declassifier,":[195],"outperforming":[196],"baselines.":[198],"Combined":[199],"with":[200,230],"lightweight":[201],"LLM-based":[202],"declassifiers,":[203],"matches":[205],"exceeds":[207],"F1":[209],"direct":[211],"LLM-as-judge":[212],"baselines":[213],"such":[214],"as":[215],"GPT-5.5":[216],"xhigh":[217],"while":[219],"using":[220],"up":[221,248],"81x":[223],"lower":[224],"cost.":[226],"flows":[228],"detected":[229],"small":[231],"surrogate":[232,246],"transfer":[234],"larger":[236],"state-of-the-art":[237],"other":[240],"families,":[242],"when":[244],"is":[247],"200x":[250],"smaller,":[251],"suggesting":[252],"black-box":[253],"deployment":[254],"gradient":[256],"access.":[257]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-24T00:00:00"}