# HiddenCode paper — arXiv submission package Author: yxpil Artifact: BrainTentacle (the agent runtime described in the paper) ## Title **Content-Addressed Redaction with Local Restoration: Secret Handling for Tool-Using AI Agents** ## Suggested arXiv classification - Primary: `cs.CR` (Cryptography and Security) - Cross-lists: `cs.AI` (Artificial Intelligence), `cs.SE` (Software Engineering) `cs.CR` is the right primary: the paper is a confidentiality mechanism and an honest measurement of where that mechanism does and does not apply. `cs.AI` covers the agent setting, and `cs.SE` covers the enforcement-audit contribution, which is a study of the gap between a documented property and the property the code actually has. ## Abstract (verbatim) > Tool-using AI agents run on a user's machine but delegate cognition to a > third-party model provider. Whenever a credential, phone number, or access > token has to appear in a prompt so that the agent can act on it, the usual > choices are to expose the secret to the provider or to prevent the agent from > acting at all. We describe and evaluate a third option, implemented in the > open-source agent runtime BrainTentacle: *content-addressed redaction with > local restoration*. Before a request leaves the machine, every occurrence of a > registered sensitive value, and every occurrence matched by an enabled regular > expression, is replaced in the copy of the conversation that will be > transmitted by a placeholder whose text is a prefix of the SHA-256 digest of > the replaced value. When the model returns tool arguments, the dispatcher > substitutes the real values back before execution, so the agent acts on a > secret it never saw. Because the placeholder derives from the value's content > rather than from an enumeration counter, the same secret carries the same > token across turns and independently of registration order; this is what makes > the token quotable by the model in a later turn. We contribute (i) a precise > description of the mechanism against the artifact, (ii) a measurement harness > that links the shipping implementation as a library and measures detector > precision and recall on a 62-document corpus of realistic and adversarial > payloads, round-trip fidelity, placeholder stability, and the collision > behaviour of truncated digests, and (iii) an enforcement audit that identifies > three concrete gaps in the current implementation, including a request path on > which redaction is not applied at all. We report only measured quantities, and > we state the limitations explicitly: the secondary audit layer is experimental > and fails open by design, and the workspace path jail is lexical with no > default root. ## Abstract for the arXiv form (1,920-character limit) The abstract printed in the paper is longer than the form accepts; paste this version into the arXiv metadata field instead. It keeps every measured number and drops only prose. > Tool-using AI agents run on a user's machine but delegate cognition to a > third-party model provider. Whenever a credential, phone number, or access > token has to appear in a prompt so that the agent can act on it, the usual > choices are to expose the secret to the provider or to prevent the agent > from acting at all. We describe and evaluate a third option, implemented in > the open-source agent runtime BrainTentacle: content-addressed redaction > with local restoration. Before a request leaves the machine, every > occurrence of a registered sensitive value, and every occurrence matched by > an enabled regular expression, is replaced in the copy of the conversation > that will be transmitted by a placeholder whose text is a prefix of the > SHA-256 digest of the replaced value. When the model returns tool arguments, > the dispatcher substitutes the real values back before execution, so the > agent acts on a secret it never saw. Because the placeholder derives from > the value's content rather than from an enumeration counter, the same secret > carries the same token across turns and independently of registration order; > this is what makes the token quotable by the model in a later turn. We > contribute (i) a precise description of the mechanism against the artifact, > (ii) a measurement harness that links the shipping implementation as a > library and measures detector precision and recall on a 62-document corpus > of realistic and adversarial payloads, round-trip fidelity, placeholder > stability, and truncated-digest collisions, and (iii) an enforcement audit > that identifies three concrete gaps, including a request path on which > redaction is not applied at all. We report only measured quantities, and > state the limitations explicitly: the secondary audit layer is experimental > and fails open by design, and the workspace path jail is lexical with no > default root. ## Files ``` main.tex the paper refs.bib bibliography common.tex shared preamble (copied in at packaging time) figures/fig1_system_context.pdf where redaction sits in the request path figures/fig2_two_audiences.pdf the trusted/untrusted view split figures/fig3_worked_example.pdf one secret through mask, quote, restore figures/fig4_collision_curve.pdf birthday bound for 6-hex and 8-hex prefixes scripts/make_figures.py regenerates every figure scripts/redaction_measure/ Rust harness that links bit-core scripts/redaction_measure/corpus/build_corpus.py regenerates the corpus scripts/redaction_measure/corpus/corpus.json the 62 hand-labelled documents scripts/results/redaction_measure.json raw harness output (the tables' source) scripts/check_mask_call_sites.py re-runs the enforcement call-site audit ``` ## Build ```bash cd papers/hiddencode cp ../_shared/common.tex common.tex pdflatex main bibtex main pdflatex main pdflatex main ``` or, with `tectonic` (which fetches packages on demand): ```bash tectonic -X compile main.tex --keep-logs ``` Note the package order: `main.tex` loads `natbib` *before* `\input{common.tex}`, and the paper uses `\citep`, so `abbrvnat` must be the bibliography style that `common.tex` selects. Do not reorder those two lines. ## Package for arXiv ```bash bash papers/make_package.sh hiddencode ``` This produces `papers/dist/hiddencode.tar.gz` with `main.tex`, `common.tex`, `refs.bib`, `figures/`, `scripts/` and this README. ## Submit 1. Go to and click **Submit new paper**. 2. Upload `papers/dist/hiddencode.tar.gz`. The source is preferred over a PDF-only record because the figure and measurement scripts ship with it. 3. Category: `cs.CR` primary; add `cs.AI`, `cs.SE` as cross-lists. 4. Copy the abstract above into the metadata form. It is 304 words and 1,918 characters as LaTeX, so it fits arXiv's 1,920-character metadata field. Do not add the `\emph{}` markup; the plain-text form is shorter still. 5. **Author identity.** The author block reads `yxpil`. Use the same name here as the arXiv account holder; if the account is registered under a Latin spelling, change `\author{}` in `main.tex` to match before packaging. 6. License: the arXiv perpetual non-exclusive license is fine. ## Reproducing the numbers The measurement harness links the *shipping* `bit-core` crate, so it needs a BrainTentacle checkout. `scripts/redaction_measure/Cargo.toml` hard-codes the relative path `../../../../_repos/BrainTentacle/crates/bit-core`; edit it to point at your checkout, then: ```bash cd papers/hiddencode/scripts/redaction_measure cargo run --release # writes ../results/redaction_measure.json cd ../.. python scripts/make_figures.py # regenerates figures/, reads the JSON ``` The harness writes the JSON itself (an optional single argument overrides the output path) and prints a one-line summary to stdout; do not redirect stdout into the results file. The shipped JSON was produced on Windows x86_64 against BrainTentacle commit `d604587`, with `bit-core` 0.1.0. To re-run the test suite quoted in the paper, use a BrainTentacle checkout at the same commit: ```bash cargo test -p bit-core --no-fail-fast ``` On Windows this executes 233 unit tests and 12 integration tests; all 245 pass. Six unit tests in the source tree are gated to Unix or to non-Windows targets and are not compiled in that configuration. Figures 1–3 are drawn from the source tree and do not need the JSON. Figure 4 degrades to the analytic birthday curve if the JSON is absent, which is why the JSON is shipped. The corpus lives in `scripts/redaction_measure/corpus/corpus.json`, one JSON object per document with a `secrets` array whose entries carry the secret text and its class; `build_corpus.py` regenerates it and asserts its invariants. Precision and recall are computed against that hand-labelled ground truth rather than against the detector's own output. The enforcement audit in the evaluation section is a code-reading result. `scripts/check_mask_call_sites.py` re-runs it against a BrainTentacle checkout and fails unless there is exactly one masking call site outside the implementation module; at the audited commit that site is `ai.rs:193`, and the agent's own turn loop uses request paths that do not reach it. ## What the paper does not claim - **That the mechanism is universally applied.** It is not. The paper's third contribution is the finding that redaction runs from one call site and that two request paths in the agent turn loop bypass it entirely. - **That pattern-matched secrets survive a round trip.** They are masked but never restored, and the paper says so. - **That the digest-prefix collision detector covers runtime-matched values.** It does not; it observes only registered values. - **That the secondary audit layer is a security control.** It is experimental and fails open by design. - **That the workspace path jail is a sandbox.** It is lexical and has no default root. - **That detector precision is complete.** It is syntactic and pattern-based; the paper measures how incomplete it is instead of asserting adequacy. - **That the corpus is representative of production traffic.** It is 62 hand-built documents, realistic and adversarial, not a sample of real usage.