In multi-agent tasks, a recipient can combine several individually innocuous fragments into information that a policy was meant to protect. The proposed Task-Graph Contextual Integrity gate maintains recipient-level exposure history and task purpose, rather than evaluating each outgoing item in isolation. MAPLE-Bench covers controlled task families and…
Inspect the ClaimsCase · DiggingBeagle record
Task-graph disclosure tracking blocks cumulative multi-agent privacy leakage
A controlled benchmark compares disclosure state tracked across recipients against local-only rules that can miss cumulative privacy leaks.
Scope
The 144-task MAPLE-Bench setup and its classification assumptions limit generalization to production data flows.
Assessment profile
Assessment method- Setting
- simulation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The source is primary to the described analysis, not independent replication of every outcome. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-TASK-GRAPH-PRIVACY-A · Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy
At a glance
Privacy controls must account for information accumulated across messages, recipients and delegations, not only the newest sentence.
Read the implicationsThe 144-task MAPLE-Bench setup and its classification assumptions limit generalization to production data flows. The paper does not demonstrate a production-scale recipient identity service or independent accuracy for sensitive-item classification across real organizations.
Limits and uncertaintyFull account
In multi-agent tasks, a recipient can combine several individually innocuous fragments into information that a policy was meant to protect. The proposed Task-Graph Contextual Integrity gate maintains recipient-level exposure history and task purpose, rather than evaluating each outgoing item in isolation. MAPLE-Bench covers controlled task families and simulated disclosures. The study illustrates cumulative flow authorization, not proof that deployments with unknown data classification enjoy the same tradeoff.
A disclosure can be individually innocuous yet reveal a protected fact when combined with items previously shared with the same recipient. The proposed task graph therefore tracks recipient-specific exposure and purpose, rather than judging each message independently. MAPLE-Bench includes 144 cases across healthcare, finance, HR and lifestyle scenarios; those are synthetic workflows with known labels. The reported privacy gains must be read alongside token cost and classification assumptions, because an incorrect identity, memory label or user grant can invalidate the gate's conclusion even when its graph algorithm is internally correct.
Mechanism and trust boundary
- 01
Track recipient exposure
A gate records what sensitive information a recipient has already received.
Boundary: Individual messages into recipient history
- 02
Assess the next disclosure in context
A task graph relates purpose and cumulative information flow.
Boundary: Local transfer decision versus cumulative knowledge
- 03
Gate the outbound message
Disclosure is allowed or denied using the graph and authorization scope.
Boundary: Agent messaging into sensitive-data release
Claims & evidence
CLM-2026-NOV02-TASK-GRAPH-PRIVACY-AThe authors report 85.8 to 94.1 percent fewer unauthorized disclosures under task-graph contextual integrity configurations while preserving 93.6 to 96.1 percent of baseline task accuracy.supported
Basis: reported finding
- supportsJudging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacyprimary disclosure
Paper, MAPLE-Bench and Privacy-Cost Trade-off experiment
Implications
Privacy controls must account for information accumulated across messages, recipients and delegations, not only the newest sentence.
Controls and mitigations
- Track recipient-specific exposure with scoped purpose and use independent checks for sensitive data shared across tools and agents.
- Maintain cumulative per-recipient disclosure history with provenance and allow only purpose-scoped grants; report blocks that prevent legitimate work alongside leakage reductions.
Unknowns and contradictions
- The 144-task MAPLE-Bench setup and its classification assumptions limit generalization to production data flows.
- The paper does not demonstrate a production-scale recipient identity service or independent accuracy for sensitive-item classification across real organizations.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214