The protected system is larger than the model

In this text-only Evidence Desk path, the model endpoint receives tokenised context and returns generated output. The surrounding application authenticates a peer, looks up entitlements, retrieves documents, builds context, invokes the model, parses the response, calls services, displays a draft and records evidence. A weakness in any of those stages can create the same visible harm.

Suppose a complaint handler sees a restricted case note. Several causes are possible:

• the note was present in adaptation data and later reproduced;
• retrieval searched the whole corpus before applying a case filter;
• a cache key omitted the peer or case scope;
• the application logged another user’s context and exposed the log;
• an indexing job placed the document in the wrong tenant;
• a tool ran with a service identity broader than the user’s identity;
• generated output combined authorised fragments into a prohibited inference; or
• an ordinary access-control defect returned the wrong record.

Calling every cause “the model leaked data” makes the investigation less accurate. Training-data memorisation, retrieval disclosure, cache isolation and authorisation require different tests and different owners.

The NIST Generative AI Profile treats generative AI risk across the lifecycle and describes itself as a voluntary, cross-sector companion to the AI Risk Management Framework.1 The UK National Cyber Security Centre’s secure-AI guidance likewise addresses design, development, deployment, operation and maintenance, including systems assembled from third-party components.2 Both are useful here because the system boundary includes the supply chain and operating environment.

Six properties, six questions

Security discussions often use a single colour for everything undesirable. The Evidence Desk instead separates six properties.

Build the context before listing attacks

An attack catalogue is not a threat model. A list can remind a team that prompt injection, poisoning or extraction exists, but it cannot say whether the Evidence Desk exposes the required surface or what damage would follow.

A compact system context records:

• the allowed purpose;
• identities and organisations;
• data stores and classifications;
• processes and external services;
• capabilities and transaction boundaries;
• trust-boundary crossings;
• deployment and administration paths;
• logging and evidence paths; and
• explicit non-goals.

Merehaven assigns the release candidate the identifier ED-RC-01. The identifier matters because evidence for one candidate must not be reused silently for another.

Trust boundaries

A trust boundary marks a change in authority, owner, process, integrity assumption or exposure. It is not synonymous with a network hop.

The Evidence Desk request crosses at least these boundaries:

1. staff device to workforce identity service;
2. authenticated session to application policy;
3. application identity to entitlement and case-allocation data;
4. authorised corpus to the ranker;
5. retrieved evidence to model context;
6. model output to the output validator;
7. provisional draft to human review;
8. policy decision to the audit store; and
9. build system to the admitted serving artefact.

Some crossings happen inside one cloud account. Some involve no network at all. A generated JSON object crossing into a payment service would be a major authority boundary even if both processes shared a host.

Describe capability, not personality

Adversary labels such as “insider” or “sophisticated attacker” are too coarse on their own. A useful record states what the actor can do.

The capability dimensions for ED-RC-01 are:

• access: no access, public interface, authenticated staff interface, corpus contribution, build access or artefact access;
• knowledge: black-box behaviour, application design, prompt and policy, model weights or source and configuration;
• query budget: one request, bounded session, sustained access or offline computation;
• identity: own account, stolen account, service identity or privileged administrator;
• content control: direct prompt, uploaded document, retrievable document, feedback, tool output or training record;
• observation: final text, scores, citations, timing, token counts, logs, gradients or model parameters; and
• goal: disclose, infer, corrupt, execute, exhaust, evade, persist or undermine evidence.

MITRE ATLAS supplies a maintained vocabulary of tactics and techniques for attacks on AI-enabled systems.3 Selected OWASP 2025 risk families include prompt injection, sensitive-information disclosure, supply-chain weakness, poisoning, improper output handling, excessive agency, system-prompt leakage, vector and embedding weakness, misinformation and unbounded consumption.4 Merehaven uses those catalogues as coverage checks after it describes its own actors and surfaces. Neither list assigns the bank’s impact or acceptance decision.

Turn a concern into a scenario

The threat register represents a scenario as:

$$T = (A, C, S, B, E, H),$$

where:

• $A$ is the actor;
• $C$ is the capability;
• $S$ is the surface;
• $B$ is the crossed boundary;
• $E$ is the observable event; and
• $H$ is the harm.

For example:

A complaint handler who can upload a document places instruction-like text in a synthetic case attachment. The text enters the authorised retrieval corpus and appears in model context. The model proposes a query for another case. The tool-policy service refuses the call because the case is outside the handler’s allocation. The attempted scope change is recorded without retaining the uploaded prose.

The scenario separates two results. The model followed untrusted text, so a behavioural control failed. The capability boundary refused the cross-case query, so the confidentiality claim held. Both findings belong in the evidence bundle.

A vague alternative such as “prompt injection leaks data” cannot tell the team which component to test or what a pass means.

Misuse, abuse, accident and dependency failure

Not every harmful path begins with a hostile outsider.

Misuse is an allowed user applying the system outside its intended purpose. A peer might use complaint evidence to draft unrelated marketing copy.

Abuse is intentional exploitation, such as a compromised account enumerating case identifiers or a curator planting poisoned content.

Accident includes an indexing mistake, a stale policy version, a cache collision or a reviewer approving the wrong draft.

Dependency failure includes a model update that changes tool-call formatting, a package compromise, an identity-provider outage or an external endpoint retaining data contrary to the expected contract.

The response differs by cause. Training a stronger refusal model will not correct a cache key. Adding a content filter will not restore an expired certificate. Threat modelling must keep conventional software and operational failures in view.

Model risk and system risk

For this book’s engineering analysis, model-level risk covers error, instability, misuse and uncertainty attributable to the model. System-level risk adds the data, software, identities, tools, people and processes that determine consequence. A formal model-risk definition from a regulator or institution must be cited and scoped separately.

The Evidence Desk uses a simple distinction:

This division prevents two common errors. The first is relying on the model to enforce a permission. The second is declaring the model harmless while the application provides an over-privileged tool.

Information persists in different places

The same sentence can exist in several forms, each with a different control owner.

“Delete the conversation” is incomplete until it says which rows, object versions, traces, caches, indexes and downstream evaluation artefacts are affected. Later chapters build the lineage needed to answer that question.

A fault tree for restricted disclosure

The top event in Merehaven’s first confidentiality analysis is:

An authorised peer receives case evidence outside the peer’s current allocation.

The team then maps candidate causal paths. A path may contain several conditions that must coincide:

• source metadata places the evidence in the wrong tenant or case, and later controls trust or fail to reconcile that metadata;
• corpus filtering is absent or late, or stale allocation data makes the evidence eligible and the result proceeds to disclosure;
• cache isolation omits identity, tenant, case, purpose or policy version;
• retrieved content causes the model to request a broader tool call, and the tool accepts it;
• a model or adapter reproduces protected training content;
• a log or evaluation store retains another request, and an unauthorised reader can access it;
• an administrator or supplier path bypasses ordinary access; or
• several individually permitted fragments combine into a prohibited inference.

The tree exposes where a control can cut a path. Pre-retrieval filtering does so only when identity, purpose, tenant, case and policy state are complete, current, correctly bound and fail-closed. Exact cache scoping can cut the cache path. A closed tool grant can cut the tool path even if prompt injection changes model behaviour. A filter on generated prose cannot cut a direct log-store exposure.

Impact is not a single likelihood score

Merehaven does not rely on a product of ordinal likelihood and consequence scores as its sole decision basis. It records the underlying dimensions, uncertainty and evidence so the owner can see what a summary rating would hide:

• number and vulnerability of affected people;
• sensitivity and reversibility of the information or action;
• financial and operational consequence;
• duration and propagation;
• detectability;
• legal or regulatory relevance;
• effect on evidence and challenge rights; and
• confidence in the scenario and available data.

These are evidence labels for a real implementation. In this fictional chapter, a path remains hypothetical unless an executable synthetic test is explicitly reported. Likelihood language is tied to a declared environment:

• observed means the event occurred in a declared test environment or documented real operation;
• demonstrated means a credible path worked under stated conditions;
• feasible means the prerequisites are present but the path was not shown;
• speculative means one or more prerequisites are unverified; and
• not applicable means an enforced boundary removes a required capability.

“Not applicable” needs evidence. If the model has no write-capable tool, an autonomous account change through that tool is outside scope. If an undocumented administrator endpoint still exposes the action, the conclusion is false.

Purpose binding precedes model access

The Evidence Desk does not ask the model whether a use is appropriate. The application checks the declared asset, processing purpose, approved data classes and time-bounded grant first.

The executable laboratory expresses the decision as a record with four outcomes to inspect:

• the grant names the exact asset;
• the grant names the exact purpose;
• every data class is allowed for that purpose; and
• both the grant and the asset are within their valid period.

Where the approved processing policy requires a recorded lawful basis or other processing authority, a missing or expired approved record causes the application to deny access before retrieval. An out-of-purpose data class is denied as well. The record supports governance; its existence does not establish legal sufficiency, which remains subject to privacy and legal review. The required test is that a denied asset is not sent to ranking, model context, cache, telemetry or a downstream processor.

This is a small example of a larger pattern: uncertain language processing begins only after deterministic identity, purpose and scope checks.

Write non-goals before choosing controls

A non-goal limits what an evaluation result can be taken to mean. For ED-RC-01, Merehaven records:

• the release does not serve customers directly;
• it does not decide a complaint or redress;
• it does not cover credit, fraud detection, marketing or employee decisions;
• it does not fine-tune on live complaint evidence;
• it does not grant internet browsing or arbitrary code execution;
• it does not expose payment, account-change or outbound-message tools;
• it does not claim differential privacy for inference;
• it does not claim that a passed red-team suite proves the absence of unknown attacks; and
• it does not treat an internal policy mapping as legal advice.

These statements reduce ambiguity, but they do not remove obligations. A system described as “decision support” can still influence a decision. The interface, review time, evidence display and quality monitoring must show that the human role is real.

The first Merehaven threat record

The release team stores the following record in its assurance repository.

The safe fixture does not need a persuasive jailbreak. It needs a token that should never change scope. That makes the test repeatable without publishing a reusable harmful prompt.

Boundary decision

Threat record THR-ED-001 binds the approved purpose and capabilities to a versioned system context, asset register, actor matrix, trust-boundary map, prohibited actions, control owners and a safe regression fixture. Misuse, accident and dependency failure are recorded separately so that one convenient attacker story cannot hide other routes to harm.

This is enough to define testable claims, not enough to release. The Evidence Desk now has a boundary within which a model version may change behaviour. It must not silently change who can see data, which evidence can enter context or what the surrounding system can do.

Representation is not removal

Language models do not consume a paragraph as an indivisible object. A tokeniser maps text to identifiers from a fixed vocabulary. The model maps those identifiers to vectors and transforms the vectors through a sequence of layers.

That representation change does not make the content harmless. An account reference split into five tokens remains an account reference when the application decodes it. An embedding derived from a restricted document remains linked to that document and may expose attributes through similarity, inversion or downstream use.1 Recoverability depends on the representation, auxiliary model or corpus, access interface and evaluation protocol. An encrypted vector store remains capable of returning the wrong authorised object after decryption if its policy is wrong.

Tokenisation

A subword tokeniser represents frequent strings directly and decomposes less frequent strings into smaller units. Byte-pair encoding, WordPiece, unigram language-model tokenisation and byte-level variants make different segmentation choices. BPE was adapted to open-vocabulary neural translation to represent rare words through subword units rather than a single unknown token.2

Consider a synthetic identifier:

MH-CUST-483921

One tokeniser might preserve common punctuation and split it into pieces resembling:

MH | - | CUST | - | 48 | 392 | 1

Another might operate on bytes or create a different grouping. These are illustrative pieces, not the output of a named tokeniser. The security conclusion does not depend on the exact split:

• a rule that looks for one token ID will be brittle across tokenisers and versions;
• text can change under Unicode normalisation, case folding or whitespace handling;
• token-level length differs from character length and affects cost and truncation;
• segmentation changes detector behaviour, context use and truncation boundaries, so controls must reason over the reconstructed string as well as individual tokens; and
• decoding recombines pieces into readable content.

A secret scanner should therefore operate on the original input and on carefully chosen normalised representations. It should also inspect decoded output. Normalisation needs a domain contract because collapsing characters can alter names, legal text or evidence. Where purpose and records policy authorise retention, the original source remains in its governed system and the detection record identifies the normalised view or transformation version used. The scanner does not create an unrestricted duplicate.

Attention routes visible context

The Transformer replaces recurrent processing with attention and feed-forward blocks.3 A decoder-style language model predicts the next token using the tokens already visible in its context.

For one attention head, a layer projects the current hidden states $X$ into queries, keys and values:

$$Q = XW_Q,\qquad K = XW_K,\qquad V = XW_V.$$

Scaled dot-product attention calculates:

$$A = \operatorname{softmax} \left( \frac{QK^\top}{\sqrt{d_k}} + M \right), \qquad Z = AV,$$

where $M$ masks positions the decoder is not allowed to use and $d_k$ is the key dimension. Each row of $A$ is a distribution over visible positions for that query under the implemented mask.

This equation supports three security observations.

First, policy text, user text and retrieved text can all influence the same calculation after the application places them in context. Markup can help the model learn a distinction, but it does not create an access-control boundary.

Second, attention weights are not a complete causal explanation. Later layers, residual paths, feed-forward transformations and interactions among heads affect the output. A colourful heat map should not be presented as proof of why a model produced a statement.

Third, visible context is an information concentration point. A request that combines a customer note, internal policy, staff instruction and tool response has assembled a new sensitive object even when every component was authorised separately.

Decoder inference creates temporary state

At inference, the model transforms the current context into logits over the vocabulary. A decoding rule then selects the next token.

Greedy decoding chooses the highest-logit token. Sampling may apply a temperature, a top-$k$ or top-$p$ restriction, repetition controls or other rules. The output is appended to the context and the process repeats until a stop condition or limit.

Security evaluation must pin these settings. An extraction result obtained with many sampled continuations under a large query budget is not comparable to one greedy request. A refusal observed once under one seed is not a stable access-control result.

Context length

For the dense attention equation above, the score matrix has $n^2$ entries for sequence length $n$. Implementations can change memory use and constant factors, and architectures can use sliding windows, sparsity or other patterns. The application should not infer a universal cost curve from the textbook matrix without measuring its chosen model and runtime.

The security trend is nevertheless clear. A larger context can hold more authorised evidence, but also:

• more personal or confidential content;
• more untrusted instructions;
• more stale or conflicting policy;
• a larger cache;
• more text available to logging or support paths;
• higher latency and cost; and
• more opportunities for relevant evidence to be lost among distractors.

The safe target is the minimum context that supports the declared task, not the maximum the model accepts.

Risk hotspots in the model path

The Transformer is one component, but its interfaces expose several distinct hypotheses.

Sampling and stop conditions

An output can continue beyond the useful answer, repeat private context or consume resources. The controller, rather than the model, enforces maximum input, output, time, tool and cost limits.

Training and adaptation move information into artefacts

Pre-training adjusts model parameters across a large corpus. Adaptation changes a base model for a narrower task or domain. The resulting artefacts can include:

• full checkpoints;
• parameter-efficient adapters;
• optimiser state;
• gradient and loss records;
• intermediate checkpoints;
• merged weights;
• quantised exports;
• tokeniser and chat-template files;
• generation configuration; and
• evaluation outputs.

LoRA represents a weight update with lower-rank matrices rather than updating the full base matrix.4 This can reduce trainable parameters and simplify the identity of an adaptation artefact. It does not make the adapter private.

For a base weight matrix $W_0$, a simplified LoRA form is:

$$W = W_0 + \alpha BA,$$

where $A$ and $B$ are trained low-rank matrices and $\alpha$ is a scaling term whose exact parameterisation depends on the implementation. The combined output depends on the base model, adapter, input and decoding. An adapter can influence reproduction of sensitive training content. Merging $BA$ into an exported weight creates another derivative that deletion must trace.

Merehaven’s first release does not adapt on complaint records. The decision avoids a difficult privacy and deletion surface rather than trying to repair it later. A synthetic-only adapter remains an educational comparison in Chapter 6.

Retrieval keeps content outside weights, not outside risk

Retrieval-augmented generation supplies external text at inference rather than relying only on model parameters.5 This makes sources easier to update and cite. It also introduces an index, ranking process, metadata, caches and a new path for untrusted content.

The control order is:

1. authenticate the peer;
2. resolve tenant, purpose and current case allocation;
3. filter the eligible corpus;
4. rank only eligible records;
5. validate document version and integrity;
6. add the minimum relevant spans to context;
7. generate a provisional output;
8. validate each material claim against authorised evidence; and
9. re-check authorisation when a peer opens a citation.

Ranking the global corpus and removing unauthorised results afterwards is unsafe. Titles, scores, timing, cache entries or context can reveal that a prohibited document exists before the filter acts.

The retrieval system is also responsible for revocation. If policy version 4 is withdrawn, version 4 must become ineligible even if its vector remains near the query. Deletion or restriction from the source must propagate to indexes, caches and derived evaluation fixtures.

Tools turn text into possible action

A model may generate:

tool: retrieve_case
case_id: MH-CASE-100042

That output is a proposal. The application determines whether:

• the tool is present in the model’s current capability set;
• the authenticated peer has an active grant;
• the tenant, purpose and case match;
• the argument names and types match a closed schema;
• the requested impact is within the grant;
• the call is inside token, time, tool and cost budgets; and
• a human approval is required.

The model cannot widen the grant by emitting a different case identifier. Document text may alter model behaviour, but deterministic policy prevents that text from changing the external grant. These are application invariants rather than prompt promises.

Tool responses return to the application as untrusted evidence. A search result, email or document may contain instruction-like text. The context renderer records provenance and a trust label for audit and model conditioning. Those labels do not enforce authority: deterministic controls outside the prompt prevent document content from changing data scope, tool grants, transaction limits or approval requirements.

One fact, five locations, five control families

The synthetic statement “the disputed transaction occurred on 12 May 2026” can be copied, transformed or referenced across five separately governed objects.

Source record. The exact case-document version is controlled by case allocation, data classification, retention, document integrity and any applicable hold.

Search record. A text span, vector and metadata are controlled by ingestion provenance, tenant isolation, pre-ranking authorisation, index version and deletion propagation.

Prompt context. The selected span is controlled by session scope, provider contract, context minimisation, cache isolation and instruction marking.

Generated draft. The statement is controlled by schema, claim-to-evidence validation, provisional status and human review.

Audit record / potential evidence. The application retains document ID, version, span, digest, policy decision and model release rather than copying the entire case paragraph into general telemetry. The record can support a claim only after provenance, integrity, access, retention and relevant completeness are established. Its existence does not prove that the recorded action was correct or authorised.

If the bank adapted a model on the statement, it would add checkpoint lineage, memorisation evaluation and possible retraining or unlearning analysis. Avoiding that copy is a design control.

This five-object trace is deliberately narrower than the complete lineage inventory. KV and response caches, tool requests and responses, provider copies, evaluation fixtures, exports, backups and replicas remain in scope for the wider assessment. A connector in Figure 2.5 means copy, transformation or reference. It does not transfer authority or make deletion propagate automatically.

The information-location inventory

Merehaven records the following fields before an object can enter the Evidence Desk:

For ED-RC-01, one simplified row reads:

The table does not prove that implementation follows the rule. It identifies the assertions that later tests must exercise.

Deletion follows lineage

Deleting one source row does not remove every derivative. The application needs a graph, not a checklist remembered during an incident.

A deletion or restriction assessment starts at the subject or source and follows:

• raw document;
• cleaned and redacted copies;
• search chunks and metadata;
• embeddings and index snapshots;
• request and response caches;
• support, trace and audit records;
• evaluation or red-team fixtures;
• fine-tuning datasets;
• checkpoints and adapters;
• merged and quantised artefacts; and
• backups, replicas and processor copies.

The resulting action may be delete, expire, restrict, retain under hold, rebuild, retrain, validate unlearning or investigate. The correct action depends on the right, purpose, exception, technical facts and evidence. A model-weight question cannot be settled by deleting an index entry, and a legal hold cannot be ignored because deletion is technically possible.

The location decision

Release candidate ED-RC-01 keeps case-specific knowledge in an authorised evidence store rather than in adapted weights. The location register binds every copy or derivative to an owner, purpose, permission boundary, retention rule and deletion route. Its context and cache scopes are explicit; retrieval filters the permitted corpus before ranking; and the capability inventory records where text can become an external action.

That decision does not make retrieval private. It makes the knowledge surface observable enough to authorise, update, cite, revoke and test. A model, index, cache, trace or tool that cannot be placed in the lineage graph cannot enter the candidate.

Define the data universe

Let $D$ be a dataset drawn from a declared domain. A randomised mechanism $M$ maps $D$ to an output in some range $\mathcal{R}$.

The domain description needs operational content:

• What constitutes one record?
• Can a person contribute several records?
• Is a conversation one unit or many messages?
• Can the same event appear in several systems?
• Are records clipped, deduplicated or sampled?
• Which releases share a population and budget?

For a synthetic complaint-statistics exercise, Merehaven defines one contribution as all eligible events from one complaint, bounded to a maximum count before the mechanism runs. That is a complaint-level unit. It is not automatically person-level because one person may have several complaints.

Changing the unit changes the claim.

Choose neighbouring datasets

Differential privacy compares the mechanism’s output distributions on neighbouring datasets.

Two common adjacency relations are:

Add or remove one. $D$ and $D'$ differ by the presence of one protected unit.

Replace one. $D$ and $D'$ have the same size but one protected unit differs.

These relations are not interchangeable. Sensitivity, noise and accounting can change with the choice. “One row differs” is also incomplete when one person can occupy many rows.

Write:

$$D \sim D'$$

only after the relation has been defined.

For the Merehaven exercise:

$D \sim D'$ when one bounded synthetic complaint contribution is added to or removed from the eligible cohort.

This statement identifies the unit, bound and relation. A user-level training claim would require a different construction that groups and bounds all training examples associated with one user.

The formal guarantee

A randomised mechanism $M$ is $(\varepsilon,\delta)$-differentially private under the declared adjacency relation if, for every pair $D \sim D'$ and every measurable set of outputs $S \subseteq \mathcal{R}$,

$$\Pr[M(D) \in S] \leq e^\varepsilon \Pr[M(D') \in S] + \delta.$$

The definition quantifies over all neighbouring pairs and all output events. Because the adjacency relation is symmetric in the usual constructions, the comparison applies with $D$ and $D'$ reversed as well.1

When $\delta = 0$, the mechanism satisfies pure $\varepsilon$-differential privacy. When $\delta > 0$, the additive term allows a bounded departure from the multiplicative comparison. A report should not hide delta in a footnote.

This definition yields several immediate corrections to common shortcuts.

• Training two models and comparing one observed sentence cannot prove DP.
• Adding arbitrary noise does not prove DP.
• A low empirical extraction rate does not prove DP.
• Encryption does not produce DP.
• A small adapter does not produce DP.
• A stated epsilon without adjacency and unit is incomplete.

NIST SP 800-226 describes differential privacy as a mathematical framework and organises evaluation around the unit of privacy, privacy parameters, algorithm correctness, trust model, query model, side channels and data-collection exposure.2 That breadth is useful because a mathematically valid mechanism can still be implemented or governed incorrectly.

What epsilon says

Epsilon controls the multiplicative term $e^\varepsilon$. For a fixed mechanism, adjacency relation, unit, delta and accounting scope, a smaller epsilon generally gives a tighter bound.

The following values show only the exponential term:

The table is not a policy ladder. It does not say that 0.5 is safe or that 2.0 is unsafe. The practical meaning also depends on the unit, delta, composition, auxiliary knowledge, participation frequency, mechanism and consequences.

Epsilon is not:

• a probability that a person is identified;
• a percentage of records protected;
• a confidence level;
• a cap on every person’s real-world harm; or
• a regulator-approved score.

What delta says

Delta is an additive slack in approximate DP. It should be stated with the same prominence and precision as epsilon.

A team may choose delta relative to the protected population and threat model, but there is no context-free rule in this book. The decision record should explain:

• the eligible population;
• the unit of protection;
• the mechanism and accountant;
• why the selected delta is appropriate;
• how many releases compose;
• whether one person can participate repeatedly; and
• who approved the residual risk.

If composition causes the cumulative delta to reach a nonsensical value, the arithmetic should fail rather than print a favourable label.

Privacy loss is an output-specific random variable

For an output $o$ with densities or probability masses $p_D(o)$ and $p_{D'}(o)$, the privacy loss in one direction is:

$$L_{D,D'}(o) = \log \frac{p_D(o)}{p_{D'}(o)}.$$

The value depends on the neighbouring pair, output and direction. Under the mechanism’s randomness, $L$ is a random variable.

Zero probabilities need careful measure-theoretic handling. A toy function that returns infinity whenever either scalar is zero loses the distinction between an impossible event under both distributions and an event possible under only one. More importantly, averaging likelihood ratios for unrelated generated strings is not a privacy accountant.

Formal accounting derives a bound from the implemented mechanism and its composition. Empirical privacy auditing asks whether attacks reveal more than expected. The two evidence streams complement each other; one cannot be renamed as the other.

Sensitivity connects the query to noise

For a numeric function $f$, global sensitivity under an adjacency relation is:

$$\Delta f = \sup_{D \sim D'} \left\lVert f(D) - f(D') \right\rVert.$$

The supremum ranges over all allowed neighbouring datasets. Bounding contribution is often what makes sensitivity finite.

Suppose the synthetic exercise releases a count of eligible complaints and each protected unit contributes at most one. Under add-or-remove-one adjacency, the count’s $L_1$ sensitivity is one. If one person can contribute an unbounded number of complaints while the claim is person-level, the same conclusion does not hold.

The Laplace mechanism and Gaussian mechanism calibrate noise under their respective definitions and conditions. The book does not implement either from scratch as production code. In a real release, use a maintained library, pin the version, verify its adjacency and sampling assumptions, and test the integration against an independent reference where the consequence warrants it.

Composition follows the protected population

Privacy cost accumulates when several mechanisms use overlapping protected data. The elementary sequential-composition result gives:

$$\varepsilon_{\mathrm{total}} \leq \sum_{i=1}^{k} \varepsilon_i, \qquad \delta_{\mathrm{total}} \leq \sum_{i=1}^{k} \delta_i.$$

This bound can be loose. Rényi differential privacy and other accounting frameworks can support tighter analysis for suitable mechanisms.3 Tighter mathematics does not remove the need to identify every release.

Merehaven’s ledger records:

• mechanism and run identifier;
• cohort;
• unit and adjacency;
• epsilon and delta;
• sampling model;
• clipping norm and noise multiplier where applicable;
• steps;
• accountant and version;
• date and owner;
• previous and cumulative budget; and
• downstream release or checkpoint.

The ledger includes experiments, hyperparameter searches and intermediate releases when they expose protected information under the chosen accounting model. Publishing only the final training job can omit most of the cost.

Post-processing

If $M$ is differentially private, any possibly randomised transformation $g$ that has no additional access to the protected dataset beyond $M(D)$ preserves the same formal guarantee:

$$M \text{ is } (\varepsilon,\delta)\text{-DP} \quad\Longrightarrow\quad g \circ M \text{ is } (\varepsilon,\delta)\text{-DP}.$$

Fixed or public side information may be supplied to $g$ without changing this statement. The relevant boundary is access to the protected data, not whether every input to $g$ is a constant.

• If a downstream component obtains another data-dependent view of the protected population, the joint pipeline is no longer mere post-processing and requires separate privacy analysis or accounting.
• Releasing several transformations of the same DP output remains post-processing, but querying the protected data again can consume additional budget.
• External retrieval can create confidentiality or authorisation failures while the original DP mechanism’s formal statement remains true.
• Post-processing does not resolve copyright, confidentiality, fairness, accuracy or purpose limitation.
• A synthetic dataset generated by a DP mechanism can inherit the mechanism’s source-data DP guarantee, but it is not automatically unrestricted or factually reliable.

Sampling amplification is conditional

Random subsampling can amplify privacy under specified sampling schemes and accounting results. The factor depends on whether sampling is Poisson, without replacement or otherwise structured, and on how individuals contribute.

“The batch is one per cent of the dataset, so privacy is one hundred times better” is not a valid general rule. The training implementation and accountant must agree on the sampling model.

Group protection is not free

A record-level guarantee does not automatically become a same-parameter guarantee for a group of related records. Group-privacy bounds generally degrade with group size. A bank cannot protect a person who contributes fifty messages by declaring each message a person.

The control is to choose the unit early, group contributions correctly and enforce a contribution bound. Where one household, business or organisation is the meaningful unit, the data pipeline and accountant must support that decision.

De-identification answers a different question

Traditional de-identification methods can be useful for structured releases. They do not produce the same claim as DP.

t-closeness

t-closeness constrains the distance between the sensitive-attribute distribution in an equivalence class and the distribution in a reference population.6 The distance measure and threshold are part of the definition.

These methods require a structured release and declared attributes. They do not prevent model memorisation, secure unstructured text, authorise a search or account for arbitrary auxiliary data.

Pseudonymisation is not anonymisation

In the UK GDPR example used here, pseudonymisation replaces or transforms identifiers and keeps the additional attribution information separately under technical and organisational controls. If Merehaven retains the key or mapping, the result remains linkable and is governed as personal data.7

Anonymisation is a contextual conclusion about whether people are identifiable by means reasonably likely to be used. Removing names is not enough when combinations, free text, rare events or external data restore identity.

Synthetic data also needs its own assessment. A generator may reproduce source records, preserve unique outliers or create inaccurate groups. The team tests duplication, nearest neighbours, membership and extraction, then separately assesses rights, utility and fairness.

Protection claims are not interchangeable

Merehaven’s privacy claim sheet

In the fictional release design, an Evidence Desk record would contain:

The optional synthetic aggregate exercise uses a separate record:

Until every entry is complete and the mechanism matches the accountant, the result cannot be described as a DP release.

Claim acceptance rule

Merehaven may use the phrase “differentially private” for a release only when its record names the data domain, protected unit, contribution bound, adjacency relation, mechanism, output range, $\varepsilon$, $\delta$, sampler, trust model, accountant, composition horizon, utility evidence, owner and expiry. The implementation and accountant must describe the same mechanism. Missing fields, an incompatible sampler or unrecorded composition changes the status to claim incomplete; empirical leakage tests cannot fill the gap.

The release sheet therefore keeps epsilon beside its unit, delta, mechanism and lifetime. Compressing those fields into one dashboard number would discard the meaning of the claim.

Name the event before the metric

“Leakage rate” is ambiguous. A useful evaluation record states:

• protected asset;
• adversary identity and access;
• prior knowledge;
• query or compute budget;
• target system and immutable version;
• input construction;
• success predicate;
• severity;
• denominator;
• repeated-trial or sampling method;
• uncertainty procedure; and
• evidence retained.

For example:

An authenticated synthetic principal allocated to MH-CASE-100042 submits 240 requests whose nearest semantic neighbour is a canary document in another tenant. A success occurs if the ranker returns that document’s identifier, title, text, score or citation at any stage.

This definition catches metadata disclosure as well as final prose. It also makes zero successes interpretable: zero out of 240 under the declared cases, not “zero risk”.

Memorisation needs a specific operational target

In this book, a memorisation finding means unexpectedly high recoverability or preference for a specific training sequence relative to declared controls and baselines. Reproduction alone does not establish that the sequence was a member of training data or that training caused the match.

Evidence that appears in an output may have come from:

• the current user input;
• conversation history;
• retrieved documents;
• a tool response;
• a cache;
• adaptation or pre-training;
• general language regularity; or
• a combination of these.

The evaluator isolates paths. A retrieval test disables generation and inspects eligible candidates. A model memorisation test runs without the target in current context or tools. A log test inspects the telemetry projection. Attribution becomes stronger as alternative paths are removed.

Memorisation is also uneven. Duplicated, unusual or highly predictable sequences may behave differently from ordinary records. An average over generic text should not stand in for the rare secrets that matter most.

Membership inference asks a binary question

A membership-inference adversary tries to determine whether a protected unit belonged to a model’s training data. The original supervised-learning attack literature showed how output behaviour can support such inference under particular access and data assumptions.1

An evaluator needs members and non-members drawn from a defensible construction. If non-members come from a visibly different time period, format or population, the attack may learn that difference rather than membership.

For one decision threshold, the confusion matrix is:

Useful measures include:

$$\operatorname{TPR} = \frac{\mathrm{TP}}{\mathrm{TP}+\mathrm{FN}}, \qquad \operatorname{FPR} = \frac{\mathrm{FP}}{\mathrm{FP}+\mathrm{TN}},$$

and:

$$\operatorname{Precision} = \frac{\mathrm{TP}}{\mathrm{TP}+\mathrm{FP}}.$$

Undefined denominators remain undefined. Returning zero can turn “no positive predictions” into apparent perfect safety.

Threshold and curve reporting

ROC-AUC summarises ranking across thresholds. It can hide performance in the low-FPR region that matters when false accusations are costly. Report:

• TPR at one or more pre-declared FPR limits;
• precision-recall behaviour for the relevant prevalence;
• confidence intervals or resampling uncertainty;
• calibration if a score is interpreted probabilistically;
• subgroup and duplication slices; and
• the result against a simple baseline.

A membership score should not be converted directly into an epsilon. Formal DP parameters and empirical attack performance describe related but different evidence.

Extraction seeks content

Extraction asks whether an adversary can recover training or otherwise restricted content through model or system interaction. Research has demonstrated training-data extraction from language models under specific access, sampling and ranking procedures.2

A defensive evaluation can study the risk without publishing a reusable harmful payload. It uses:

1. synthetic canaries or approved test strings;
2. an isolated model or application version;
3. benign prompt families;
4. a declared generation and query budget;
5. deduplication of candidate outputs;
6. matching against the authorised synthetic target set;
7. human severity review; and
8. separate public and restricted evidence records.

The adversary record states whether it sees text only, token probabilities, embeddings, weights or gradients. Those interfaces differ materially.

The public report retains aggregate scores, protocol and non-operational evidence, and does not publish successful payloads. The restricted evaluation record keeps only the authorised material needed for reproducibility, such as a synthetic fixture identifier and digest, a pinned prompt-set version, or an encrypted controlled attachment with access and retention limits. Real extracted secrets are never retained merely to make a test reproducible.

Reconstruction estimates an input or attribute

Reconstruction tries to recover a record, feature or representative input from a model, gradient, aggregate or other observation. Model inversion is one related family.3

The metric follows the object:

• mean absolute or squared error for bounded numeric attributes;
• exact match for closed categorical fields;
• edit distance or field-level accuracy for structured text;
• intersection over union for a set;
• perceptual or task-specific measures for images; and
• success against a pre-declared harmful inference.

No single semantic score can prove that a record was reconstructed. An evaluator should compare with a prior-only baseline. If median income in the cohort already predicts an attribute well, the model may add little adversarial advantage.

Synthetic canaries create a controlled target

A canary is a synthetic sequence inserted deliberately so the evaluator knows its provenance and exposure. The Secret Sharer work formalised an exposure measure based on how highly a model ranks the canary among a defined candidate space.4

For candidate space size $N$ and one-based canary rank $r$, the reference laboratory uses:

$$\operatorname{exposure} = \log_2 N - \log_2 r.$$

Top rank gives $\log_2 N$; last rank gives zero. The candidate construction, rank procedure and model access are part of the result.

A complete canary report states:

• generation rule and candidate space;
• insertion count and locations;
• training or adaptation version;
• prompt families;
• decoding and rank method;
• total query budget;
• exposure and extraction results;
• uncertainty or repetition;
• false-positive checks; and
• whether the canary resembles natural sensitive content.

Failure to extract the canary does not prove that other data cannot be extracted. A canary is one controlled signal.

Retrieval disclosure needs a system test

The Evidence Desk’s highest-priority confidentiality test does not require membership or extraction machinery. It constructs authorised and prohibited documents whose semantic content is deliberately similar, then verifies:

1. tenant and case policy produce the eligible document set;
2. ranking receives only that set;
3. prohibited identifiers do not appear in candidates, scores, titles or snippets;
4. cache keys include the relevant scope;
5. generated citations resolve only to eligible versions; and
6. opening a citation repeats the authorisation check.

The test runs again after:

• document revocation;
• case reassignment;
• policy-version change;
• session expiry;
• index rebuild;
• model change; and
• cache restoration.

A vector-space nearest neighbour in another tenant should never become a candidate. Noise added after global ranking does not repair that boundary.

System-prompt disclosure need not expose a credential or customer record

A system prompt may be disclosed or inferred. The architecture should assume that possibility.

Treat the prompt as disclosable and never place credentials, private keys or customer records in it.

The prompt must not contain:

• credentials;
• encryption keys;
• hidden entitlements;
• customer secrets;
• irreversible safety dependencies; or
• instructions whose disclosure grants access.

Testing prompt disclosure can still identify policy and intellectual-property exposure. It should not be confused with proving that an application is compromised. If full prompt disclosure leaves the capability and data controls intact, the design has removed a fragile dependency.

Count events and report uncertainty

For $s$ successes in $n > 0$ trials, the observed rate is:

$$\widehat{p} = \frac{s}{n}.$$

The Book 04 laboratory reports a Wilson score interval. It returns an error for zero trials and an exact zero or one endpoint at the corresponding observed boundary, while retaining a non-zero uncertainty bound.

Worked calculation: if 0 of 240 declared synthetic trials succeeded for a pinned candidate, the observed sample rate would be 0 per cent and the 95 per cent Wilson interval would be approximately 0 to 1.58 per cent. This hypothetical calculation is not a Merehaven test result. Its bounded interpretation would be:

In this worked calculation, the sample contains 0 successes in 240 trials; the upper end of the 95 per cent Wilson interval is approximately 1.58 per cent.

It is not:

The system has zero leakage.

The trials also need coverage. Two hundred and forty near-duplicate prompts may be less informative than a smaller stratified set that exercises tenant, case, revocation, cache and citation boundaries.

Compare a defence in absolute and relative terms

Suppose one synthetic behavioural test observes 18 successes in 100 trials before a control and 4 in 100 afterwards.

The absolute reduction is:

$$0.18 - 0.04 = 0.14,$$

or 14 percentage points.

The relative reduction is:

$$\frac{0.18 - 0.04}{0.18} \approx 0.778,$$

or about 77.8 per cent.

The 95 per cent Wilson intervals are approximately 11.7 to 26.7 per cent before and 1.6 to 9.8 per cent after. The comparison is illustrative; it is not a Merehaven production measurement.

If the baseline is zero, relative reduction is undefined. The reference code returns None. If the new rate is higher, the reduction is negative. A metric should expose both outcomes.

Behavioural improvement also does not prove confidentiality. A deterministic scope check may block impact even when the behavioural attack still succeeds.

Severity prevents averaging away the important failure

An overall attack success rate can hide a single high-impact disclosure among many low-impact refusal tests. Merehaven reports at least:

• results by threat family;
• results by consequence;
• full and partial success;
• zero-tolerance classes;
• uncertainty;
• adaptive versus fixed attacks;
• ordinary-task utility;
• false-positive or over-refusal burden;
• latency; and
• cost.

A cross-customer document disclosure is not balanced out by hundreds of successful refusals to benign nonsense. Release gates inspect mandatory scenarios individually.

The evaluator is itself an attack surface

An evaluator consumes model output, attack fixtures, labels and sometimes untrusted content. It needs:

• fixed system and evaluator versions;
• a sealed test split;
• safe fixture provenance;
• independent or diverse judging where feasible;
• deterministic parsers for objective properties;
• protection from prompt injection in evaluated text;
• reviewer blinding where relevant;
• duplicate and contamination checks;
• raw per-trial records;
• an immutable result digest; and
• a correction process.

Using the same model to generate, attack and judge can create correlated errors. A model judge may be one signal, but a deterministic policy failure should not be delegated to it.

The Merehaven leakage protocol

The pre-release protocol for ED-RC-01 contains five suites.

The evaluation stop rule

No favourable average can release a candidate with a confirmed cross-scope disclosure. Each result remains attached to its adversary, success predicate, denominator, severity, exact system version and immutable per-trial record. Undefined ratios stay undefined; uncertainty accompanies observed rates; evaluator provenance and contamination checks travel with the report.

Empirical evidence is bounded to the protocol that produced it. A formal privacy claim is bounded separately to its mechanism and accounting record. Neither kind of evidence silently upgrades the other.

Minimise before transforming

Data minimisation follows purpose. The question is not “How much can the pipeline ingest?” but “Which fields and records are necessary for the declared outcome?” The ICO describes data minimisation as keeping personal data adequate, relevant and limited to what is necessary for the specified purpose.1 Its current purpose-limitation guidance also requires purposes to be specified and documented, and requires a compatibility and lawful-basis assessment when information is reused.2

Merehaven applies five gates before a document can enter either retrieval or adaptation:

1. Purpose: does the proposed use match the approved processing purpose?
2. Authority and rights: may Merehaven process the material in this way, including personal-data, confidentiality, contractual and copyright considerations?
3. Necessity: which fields, passages or labels are required for the task?
4. Quality and provenance: is the source current, attributable, correctly classified and free from unresolved integrity concerns?
5. Destination: is the surviving content permitted in retrieval, evaluation, transient context, telemetry or adaptation?

The destination matters because each one creates a different persistence pattern. A short-lived prompt is not equivalent to a checkpoint copied to three registries. A vector record is not equivalent to the source document. A redacted evaluation fixture is not automatically suitable for training.

For a fictional intake of 18,400 document versions, the Evidence Desk might retain 12,700 after purpose and rights review, 9,850 after classification and quality checks, and 7,900 after deduplication and necessity review. It could route 7,620 to retrieval, 220 to an isolated evaluation set and only 60 reviewed, synthetic style examples to an adaptation experiment. These numbers illustrate the ledger; they are not a recommended ratio or a production result.

Counting records is insufficient on its own. A single retained attachment may contain more sensitive information than thousands of public policy pages. The manifest records bytes, tokens, document classes and high-risk fields alongside record counts.

“Internal” is not a rights category

A repository inside the organisation can contain:

• customer and employee personal data;
• special-category or criminal-offence data;
• confidential correspondence;
• legal advice or privileged material;
• third-party reports under limited licences;
• trade secrets;
• regulator or law-enforcement material with handling restrictions;
• obsolete drafts whose use would be misleading; and
• content copied from a source whose provenance was never recorded.

The ingestion manifest therefore asks who supplied each object, which rights or authority support the proposed processing, which contractual limits apply, and when that conclusion must be reviewed. “Owned by the bank” is not accepted as a substitute.

Section 29A of the Copyright, Designs and Patents Act 1988 permits specified copying where the person has lawful access, the computational analysis is solely for non-commercial research, and sufficient acknowledgement is given unless that is impractical. A copy made under the section cannot be transferred or used for another purpose without the copyright owner’s authorisation.3 Commercial model training therefore needs a separate rights analysis and may require permission or a suitable licence.4 The provision does not resolve confidentiality, contract, data-protection or privilege questions. The UK government’s March 2026 copyright and AI report is a policy record, not a general licence for model development.5 A US fair-use decision does not determine the UK position.

Merehaven’s minimum ingestion record is:

The record supports a review; it does not prove that a legal conclusion is correct. Legal and privacy owners remain responsible for the conclusion and its scope.

A transformation is not provenance

Redaction, pseudonymisation, anonymisation and synthetic generation answer different questions.

Redaction replaces detected content. It can reduce exposure in a declared field or text stream, but a pattern library has false negatives. Names, account references, free-form addresses and contextual identifiers do not obey one regular expression. A replacement can also leave enough surrounding information to identify a person.

Pseudonymisation separates an identifier from additional information needed to attribute the record to a person. The ICO is explicit that pseudonymised information remains personal data for a party able to reconnect it, and that the additional information must be kept separately and protected.6

Anonymisation aims to make people no longer identifiable considering means reasonably likely to be used. It is a property of the released information in context, not the name of a transformation function. The ICO’s 2025 anonymisation guidance was under review for Data (Use and Access) Act changes at this edition’s cut-off, so a real assessment must check the current version.7

Synthetic data is generated rather than directly observed. It can support testing when source data cannot be used, but its privacy depends on how it was produced and evaluated. A generator trained on sensitive records may reproduce or reveal them. A perfectly private generator can still create unrealistic data that makes an evaluation worthless.

Merehaven never overwrites a source and calls the result clean. It creates a new immutable version with:

• the input digest;
• transformation code and configuration versions;
• detection rule versions;
• counts by declared pattern;
• reviewer and exceptions;
• output digest;
• destination approval; and
• known limitations.

The protected source remains under its own retention and access policy. The transformed derivative may have a different policy, but its lineage cannot disappear.

Discovery tools are measurement instruments

Personal-data and secret scanners help triage a corpus. They do not prove that the remaining text is anonymous, lawful or safe to train on.

A defensible discovery evaluation includes:

• a labelled synthetic and approved test set;
• categories relevant to the actual corpus, languages and document formats;
• normalisation and optical-character-recognition behaviour;
• precision, recall and severity by category;
• false negatives under misspelling, spacing and formatting variation;
• nested archives, tables, images, comments and document metadata;
• secrets, credentials and private keys as a separate control family;
• reviewer disagreement;
• a quarantine path for uncertain records; and
• a rule for scanner or corpus changes that invalidate evidence.

The pipeline scans before tokenisation and again after format conversion because conversion can expose or lose text. It scans structured metadata separately from body content. It does not claim that tokenisation reconstructs properly removed information.

For telemetry, the reference laboratory deliberately recognises only fictional formats:

import re

from reference_implementation import RedactionRule, redact_for_logging

rules = (
    RedactionRule(
        "synthetic-customer",
        re.compile(r"MH-CUST-\d{6}"),
        "<SYNTHETIC_CUSTOMER>",
    ),
    RedactionRule(
        "synthetic-case",
        re.compile(r"MH-CASE-\d{6}"),
        "<SYNTHETIC_CASE>",
    ),
)

result = redact_for_logging(
    "MH-CUST-123456 opened MH-CASE-654321.",
    rules,
)

assert "MH-CUST-123456" not in result.redacted_text
assert result.replacement_counts == (
    ("synthetic-customer", 1),
    ("synthetic-case", 1),
)

The function checks type, rule identity, literal replacement and idempotence contracts. It also refuses a rule that leaves an observed matched value in the result. Those checks make the example testable; they do not turn two synthetic patterns into a general personal-data detector.

Authorise the corpus before ranking

Similarity is not permission. If a peer must not know a document exists, that document cannot participate in global nearest-neighbour search for the request.

Let $C$ be the indexed corpus, $q$ the schema-validated request and $u$ the authenticated principal. The value $q.\mathrm{purpose}$ is a trusted application field bound to the approved operation; it is never inferred from the request’s natural-language text. Let $t$ be the time at which the authorisation decision is made. A policy decision produces:

$$C_{\mathrm{allowed}}(u,q) = \left\{ d \in C \;\middle|\; \begin{aligned} &d.\mathrm{tenant}=u.\mathrm{tenant},\\ &d.\mathrm{case}\in u.\mathrm{active\_cases},\\ &d.\mathrm{purpose}\text{ permits }q.\mathrm{purpose},\\ &d.\mathrm{sensitivity}\le u.\mathrm{clearance},\\ &d.\mathrm{valid\_from}\le t<d.\mathrm{valid\_until},\\ &d.\mathrm{status}=\mathrm{active} \end{aligned} \right\}.$$

Case-independent policy documents use an explicit global_policy entitlement branch with their own document-class and purpose rules. They are not made to pass a fictional case identifier, and their existence is not treated as public by default.

Only then may the ranker compute:

$$R = \operatorname{TopK}_{d \in C_{\mathrm{allowed}}(u,q)} s(q,d).$$

The unsafe order computes TopK over $C$ and filters afterwards. That path can leak through candidate identifiers, timing, scores, snippets, caches, traces or model context even if the final answer hides the document.

The executable laboratory makes the same order visible. This compact listing exposes the filter-before-ranker boundary for four fields; a production policy adapter must also enforce trusted purpose, validity interval, grant state and any document-class rule shown above.

from reference_implementation import (
    Document,
    Principal,
    RetrievalRequest,
    authorised_documents,
)

principal = Principal(
    principal_id="staff-17",
    tenant="merehaven",
    case_ids=frozenset({"MH-CASE-100042"}),
    sensitivity_ceiling=2,
)

documents = (
    Document(
        "doc-allowed",
        "merehaven",
        "MH-CASE-100042",
        2,
        True,
        "Synthetic authorised evidence.",
    ),
    Document(
        "doc-other-tenant",
        "other-bank",
        "MH-CASE-100042",
        1,
        True,
        "Semantically similar but prohibited evidence.",
    ),
)

eligible = authorised_documents(
    RetrievalRequest(
        principal,
        frozenset({"MH-CASE-100042"}),
    ),
    documents,
)

assert tuple(document.document_id for document in eligible) == (
    "doc-allowed",
)

Production filtering may use row-level policy, separate indexes, signed corpus snapshots or a policy-aware retrieval service. The implementation differs; the invariant is that prohibited records do not reach ranking.

The same authorisation is checked again when a citation is rendered or opened. A peer’s allocation can change after generation, and a cached link does not preserve an old permission.

A grounded answer is a set of traceable claims

“The answer cited three documents” says little about whether a specific sentence is supported.

The Evidence Desk assigns each material proposition a stable claim identifier. Its evidence record contains:

An entailment score can help prioritise review, but it does not confer authority. Deterministic checks verify that the source version exists, the digest matches, the span is within bounds and the peer remains authorised. A reviewer resolves substantive support and contradiction.

The displayed answer distinguishes:

• directly supported statements;
• calculations derived from cited inputs;
• uncertainty or missing evidence;
• model-generated organisation or wording; and
• the human’s final decision.

This avoids a citation becoming decoration at the end of a fluent paragraph.

Retrieval creates its own attack surface

Keeping knowledge outside weights changes the risks rather than removing them.

Ingestion poisoning. A legitimate upload channel can introduce false facts or instruction-like text. Provenance, quarantine, integrity review and corpus admission policy control whether the object enters an active index.

Indirect prompt injection. Authorised evidence can contain language that changes model behaviour. Evidence is marked as untrusted data, while tool and data authority remain outside the model.

Stale or revoked evidence. An old vector record can survive after the source is withdrawn. Index rebuilds, tombstones, cache invalidation and open-time authorisation need testable service-level objectives.

Metadata disclosure. Titles, scores, document counts, timing and “no result” behaviour can reveal sensitive relationships even when body text is hidden.

Embedding and index exposure. Embeddings can preserve information about source content, and the index is a concentrated derived store. It receives access, encryption, backup, deletion and monitoring controls appropriate to the source sensitivity.

Cross-scope caching. A result cache, prefix cache or response cache can bypass a correct retriever if its key omits tenant, principal, purpose, case, policy version or corpus snapshot.

Citation confused deputy. A generated link can ask a document service to use the application’s broad identity instead of the peer’s bounded identity. Opening the source repeats policy with the human principal.

OWASP’s 2025 vector and embedding category is useful as a coverage prompt, but it is not an access-control design.8 Merehaven keeps the policy invariant and threat tests specific to its architecture.

Logs are concentrated datasets

An observability stack can collect the query, retrieved passages, system policy, generated draft, reviewer edits, tool arguments, identifiers, timing and errors in one place. That combination may be more sensitive than any single source store.

The Evidence Desk separates three records:

1. Operational metrics: counts, latency, resource use and bounded error codes without prompt text.
2. Audit evidence: principal pseudonym, purpose, policy result, corpus digest, evidence references, model and prompt versions, action proposal and approval result.
3. Controlled diagnostic capture: a sampled, time-limited and separately authorised payload available only when the issue cannot be investigated from the first two records.

Raw prompts and responses are off by default. Enabling diagnostic capture requires a purpose, owner, expiry, access group and deletion test. Vendor-side retention, abuse monitoring, support access and regional processing are part of the data-flow and contract review.

A prompt-tracing product is not granted an exemption from minimisation because it is called observability.

Erasure is a routed decision, not one delete call

Under UK GDPR Article 17, the right to erasure applies in specified circumstances and is not absolute. The ICO’s guidance also addresses recipients and copies when personal data has been disclosed.9 Whether a particular right applies, an exemption matters, or a model artefact processes identifiable personal data requires case-specific legal and privacy analysis.

Merehaven uses this engineering route:

1. authenticate the requester and scope the request;
2. determine the applicable right, data and any exemption or retention duty;
3. place an immediate future-use block where appropriate;
4. locate the information through source, derivative, processor and recipient lineage;
5. delete, restrict, suppress or retain under hold according to the approved decision;
6. rebuild or invalidate indexes, caches and derived datasets;
7. assess checkpoints, adapters, merged weights and downstream models rather than assuming their status;
8. test the effectiveness of the chosen action;
9. notify processors or recipients where required and track completion; and
10. retain a minimised decision record, limitations, reviewer and response.

Deleting a source row does not prove that replicas, backups, embeddings, logs or vendor stores have been addressed. Deleting a vector record does not untrain a model. Removing an adapter removes that artefact’s contribution from one declared serving composition; it does not perform record-level unlearning or find merged and exported copies.

Machine unlearning is a family of methods whose claim and evaluation must be stated precisely.10 Some research provides formal guarantees under declared algorithms and assumptions; other work reports empirical change under selected attacks or utility tests.11 A method might reduce influence under one extraction or membership protocol without reproducing a retrained-from-scratch model. Approximate suppression is not automatically legal erasure. Conversely, retraining is not automatically required for every request. The approved response follows the facts, applicable law, technical evidence and retained obligations.

The reference planner exposes gaps instead of asserting success:

from datetime import UTC, datetime, timedelta

from reference_implementation import LineageNode, plan_deletion

now = datetime(2026, 7, 28, 9, 0, tzinfo=UTC)
nodes = (
    LineageNode(
        "source-case-17",
        "source",
        frozenset({"subject-17"}),
        ("vector-row-17", "adapter-checkpoint-4"),
        True,
    ),
    LineageNode(
        "vector-row-17",
        "retrieval-index",
        frozenset(),
        (),
        True,
    ),
    LineageNode(
        "adapter-checkpoint-4",
        "adapter",
        frozenset(),
        (),
        False,
        expires_at=now + timedelta(days=30),
    ),
)

plan = plan_deletion("subject-17", nodes, now)

assert tuple(step.action for step in plan.steps) == (
    "delete",
    "expire",
    "delete",
)

The output orders downstream action before the source. It says expire for the non-deletable synthetic adapter because this fixture declares an expiry. A node with neither targeted deletion nor expiry is marked investigate. A production rights workflow still needs the legal decision, processor response and effectiveness evidence.

Corpus release checkpoint

Corpus snapshot ED-RC-01 can be promoted only while all of these conditions hold:

• every active object has immutable source identity, digest, provenance, classification, rights review, destination approval and current validity;
• trusted tenant, purpose, case or global-policy entitlement, sensitivity, time and grant state construct the candidate corpus before semantic ranking;
• each retrieved passage carries its source version, digest, span and policy decision, and opening a citation repeats authorisation;
• uploads and retrieved text remain untrusted data, while admission, tool and instruction authority stay outside the model;
• source revocation exercises tombstone, index rebuild, cache invalidation and citation-open tests;
• ordinary telemetry excludes prompts, evidence and drafts; exceptional capture has a named purpose, owner, scope, expiry and deletion test; and
• a rights request traverses sources, replicas, indexes, caches, processors and model artefacts, recording what was deleted, restricted, expired, retained or left for investigation.

That checkpoint keeps live case facts and changing policy out of model adaptation. The remaining question is narrower: can a reviewed, non-sensitive corpus improve structure or terminology enough to justify another persistent artefact? The answer must come from a measured adaptation experiment, not from the convenience of fine-tuning.

Choose the technique by the observer and asset

The first line of a technique-selection record names:

• the protected asset;
• the observer or adversary;
• the information the observer can see;
• the computation that must remain possible;
• the output that may legitimately be learned;
• the integrity and availability requirements;
• the trust and collusion assumptions;
• the permitted residual leakage; and
• the evidence needed for release.

Only then does the team compare methods.

For ED-RC-01, governed retrieval already keeps case facts current and scoped. Differentially private training would not repair a cross-tenant retrieval bug. Homomorphic encryption would not make an unsupported draft reliable. Federated learning would introduce participant and aggregation risks without a cross-entity training need. The default remains no private fine-tune.

LoRA changes fewer parameters, not fewer obligations

Low-Rank Adaptation freezes an existing weight matrix $W$ and learns a low-rank update. One common representation is:

$$W' = W + \frac{\alpha}{r}BA,$$

where $A$ and $B$ are trainable matrices, $r$ is the chosen rank and $\alpha$ scales the update.1

For this convention,

$$W\in\mathbb{R}^{d_{\mathrm{out}}\times d_{\mathrm{in}}}, \qquad A\in\mathbb{R}^{r\times d_{\mathrm{in}}}, \qquad B\in\mathbb{R}^{d_{\mathrm{out}}\times r}, \qquad 1\le r\le\min(d_{\mathrm{in}},d_{\mathrm{out}}).$$

This can reduce training memory, trainable parameter count and per-variant storage. It can also make it easier to keep separate task variants. None of those properties bounds the influence of one training record.

The served behaviour depends on more than the adapter:

$$y \sim p\!\left( y \mid x,\, W,\, A,\, B,\, \tau,\, c,\, \pi \right),$$

where $x$ is input, $\tau$ represents tokenisation and decoding, $c$ is current context and $\pi$ is surrounding application policy. Sensitive influence can appear in the combined output even though the base matrix is frozen.

QLoRA keeps a quantised base model and trains low-rank adapters to reduce memory requirements.2 Quantisation does not create a privacy guarantee. A DP claim for LoRA or QLoRA depends on the actual per-sample-gradient path, optimiser, quantisation path, library, sampling, clipping, noise and accountant versions. Compatibility should be demonstrated, not inferred from the method names.

Merehaven’s adapter record includes:

• immutable base-model and tokenizer digests;
• LoRA target modules, rank, scale and dropout;
• training-code, optimiser and library versions;
• source and evaluation manifests;
• full, quantised and merged artefact identities;
• canary, membership and extraction results;
• intended serving composition;
• downstream exports and caches;
• approval and expiry; and
• the tested removal and rollback procedure.

Deleting one adapter is an artefact-lifecycle action. It may remove the adapter from a declared serving composition, but it does not locate merged weights, quantised exports, checkpoints, optimiser state, logs or downstream copies. It is not record-level unlearning.

DP-SGD has a specific operation order

Differentially private stochastic gradient descent modifies a training procedure so each protected unit has a bounded contribution before calibrated noise is added. The original DP-SGD work combines per-example clipping, noise and privacy accounting.3 NIST SP 800-226 emphasises that a useful claim must also identify the privacy unit, neighbouring relation, mechanism and composition.4

The equations below pin one convention rather than describing every DP-SGD implementation. Let a dataset contain $N>0$ protected units, choose a declared expected lot size $L$ with $0<L\le N$, and set $q=L/N$. At step $t$, Poisson sampling includes each unit independently with probability $q$, producing a random set $B_t$. The neighbouring relation is add or remove one protected unit. For each sampled unit, first compute:

$$g_i = \nabla_\theta \mathcal{L}(\theta_t;x_i), \qquad i\in B_t.$$

Clip each gradient independently to a declared norm $C>0$:

$$\bar{g}_i = \frac{g_i}{ \max\!\left( 1, \frac{\lVert g_i\rVert_2}{C} \right) }.$$

Add Gaussian noise with multiplier $\sigma>0$ to the clipped sum, then normalise by the declared expected lot size $L$:

$$\widetilde{g}_t = \frac{1}{L} \left( \sum_{i\in B_t}\bar{g}_i + \mathcal{N}\!\left( 0,\, \sigma^2 C^2 I \right) \right).$$

The optimiser uses $\widetilde{g}_t$. Privacy accounting must use this exact Poisson sampler, expected-lot-size normaliser, clipping rule, Gaussian mechanism, step count, adjacency relation and composition. A fixed-cardinality sampler or realised-batch-size normaliser is a different mechanism and needs a matching analysis.

Several details can invalidate a claim:

• a “record” contains several correlated events for one person while adjacency protects one event;
• microbatching changes the effective protected unit;
• gradient accumulation is omitted from accounting;
• the sampling implementation differs from the accountant’s assumption;
• clipping occurs after examples have been combined;
• distributed workers expose unclipped contributions to an observer outside the threat model;
• training restarts or hyperparameter searches consume privacy budget without being recorded;
• noise is calibrated to a different clipping convention;
• an accountant conversion silently changes $\delta$; or
• a library update changes per-sample gradient behaviour.

The reference laboratory does not implement a training loop. It validates the release record and performs only elementary sequential composition:

from reference_implementation import DPRecord, basic_compose

round_1 = DPRecord(
    mechanism_id="synthetic-adapter-run-01",
    cohort_id="synthetic-style-cohort",
    epsilon=1.1,
    delta=1e-6,
    adjacency="add-or-remove-one-synthetic-example",
    unit_of_protection="synthetic-example",
    sampling_model="poisson",
    clipping_norm=1.0,
    noise_multiplier=1.3,
    steps=120,
    accountant="rdp-accountant-v1.0",
)

round_2 = DPRecord(
    mechanism_id="synthetic-adapter-run-02",
    cohort_id="synthetic-style-cohort",
    epsilon=0.7,
    delta=1e-6,
    adjacency="add-or-remove-one-synthetic-example",
    unit_of_protection="synthetic-example",
    sampling_model="poisson",
    clipping_norm=1.0,
    noise_multiplier=1.5,
    steps=80,
    accountant="rdp-accountant-v1.0",
)

upper_bound = basic_compose((round_1, round_2))

assert upper_bound.epsilon_upper_bound == 1.8
assert upper_bound.delta_upper_bound == 2e-6
assert upper_bound.method == "basic sequential composition"

The numeric inputs are fictional records, not a recommended policy or a claimed accountant output. The function checks consistency and sums declared bounds. It does not prove that either mechanism was implemented correctly and does not replace a mechanism-specific accountant.

The privacy-utility frontier must be measured

More clipping can distort useful gradients. More noise can reduce the information learned from individuals while also reducing task performance. The result is not one universal curve because it changes with model, data, optimiser, task, protected unit, sampling and metric.

Merehaven’s comparison plot would show:

• schema completion and factual-support measures;
• ordinary-task refusal burden;
• extraction and membership results;
• epsilon and delta from the pinned accountant;
• clipping and noise parameters;
• uncertainty over repeated seeded runs;
• training and serving cost;
• subgroup slices; and
• the non-private prompt-and-template baseline.

A lower epsilon is a tighter mathematical bound under the declared mechanism. It does not guarantee that the model is useful, fair or secure. A failed extraction test does not upgrade a non-DP mechanism into DP. A strong DP record does not authorise the underlying data use.

For the synthetic-only adapter, a DP mechanism may be unnecessary because the fixtures contain no personal data. Running the experiment can still teach the release process, but the team must not market the result as protection of customer records that never entered the dataset.

Federated learning changes topology

Federated learning coordinates training across participants that retain local datasets. In a simplified weighted aggregation round:

$$\theta_{t+1} = \theta_t + \sum_{k\in S_t} \frac{n_k}{\sum_{j\in S_t}n_j} \Delta_k,$$

where $\theta_t,\Delta_k\in\mathbb{R}^{p}$, $S_t\ne\varnothing$, and every $n_k>0$, so the denominator is positive. The aggregation authority records $n_k$ as either a verified eligible-example count or an approved non-data-size weight; it is not accepted merely because a client declared it. The original federated averaging work focused on communication-efficient learning from decentralised data.5

Raw records are intended to remain at the participant. Information can still leave through:

• gradients, weight deltas or adapter updates;
• participation and dropout patterns;
• update sizes and timing;
• intermediate and final models;
• evaluation outputs;
• error messages and diagnostics; and
• maliciously chosen queries or model states.

Published gradient-reconstruction work demonstrates that shared gradients can reveal information under particular assumptions.6 Its applicability depends on model, batch, observation and optimisation access, but it rules out the slogan that local raw data alone makes federation private.

A federation threat record names:

• whether the coordinator is honest, curious or malicious;
• how many participants may collude;
• whether clients may be malicious or Sybil identities;
• which party sees an individual update and when;
• how clients authenticate a round and model version;
• how clipping is enforced or attested;
• where any DP noise is added;
• the secure-aggregation threshold;
• dropout and recovery assumptions;
• replay, rollback and participant-revocation controls;
• poisoning and backdoor evaluation;
• output and final-model access; and
• who can stop or unwind a round.

Central DP and local DP expose different intermediates. If the coordinator sees an unclipped or unnoised individual update before central aggregation, the final DP release claim does not hide that update from the coordinator. Local DP changes the message before it leaves the participant, usually with a different utility cost. The record must show the exact noise location.

Merehaven includes federation only as a fictional research sandbox using generated event patterns. No real institution participates, no financial-crime data is exchanged, and no regulator position is claimed. Any real cross-entity project would require separate review of confidentiality, privacy roles, competition, financial-crime restrictions, sanctions information, tipping-off, model ownership, participant exit and supervisory expectations.

Secure aggregation hides an update, not its quality

A secure-aggregation protocol can let a coordinator learn the aggregate of participant updates without learning each update in the clear, subject to its participation, dropout and collusion assumptions. Practical protocols have been designed for federated settings with many users and dropouts.7

The protocol still needs answers to:

• Which participant identities are admitted?
• What is the minimum aggregation set?
• Which collusions can reveal an update?
• How are dropouts recovered without exposing masks or shares?
• Can a participant submit an unbounded or malformed update?
• Is clipping verified before aggregation?
• Can an attacker replay an old update or round?
• Who learns the final aggregate and model?
• What happens when the threshold is not reached?

Encryption can hide a malicious update from inspection while it poisons the model. Integrity controls therefore sit beside confidentiality: authenticated rounds, schema and dimension checks, bounded norms, robust aggregation research, canary tasks, anomaly evidence, staged release and rollback.

Secure aggregation also does not prevent membership or extraction attacks on the final model. Differential privacy can complement it, but the composition and trust model must say who sees what before noise is applied.

MPC, homomorphic encryption and confidential computing differ

NIST’s privacy-enhancing cryptography project describes MPC as jointly computing over distributed private inputs and fully homomorphic encryption as computing over encrypted data.8 These are families of techniques, not one performance profile.

General MPC distributes a computation across parties so the protocol reveals only the permitted output under its security model. The design must specify honest or malicious adversaries, corruption threshold, abort and fairness behaviour, preprocessing, communication, authentication and output handling. A permitted output can itself reveal sensitive information, so minimisation or DP may still be required.

Homomorphic encryption lets an evaluator perform supported operations on ciphertext so decryption yields the corresponding operation on plaintext. Scheme, parameter and circuit choices determine correctness, security, precision, ciphertext expansion and cost. It does not automatically hide access patterns, message size, timing or the final output from its recipient. Key generation, custody, rotation and threshold decryption remain system controls.

Confidential computing protects data in use by running admitted code in a hardware-based, attested trusted execution environment.9 In a common deployment, a relying party evaluates attestation evidence against verifier policy before a key broker releases a scoped key or a controller admits the workload. The trusted computing base, firmware and microcode, debug state, verifier policy, key broker, rollback protection and supply chain all matter. The host still controls input, output, scheduling and network paths, and side-channel claims require workload-specific evidence.

A useful combination might run a small approved statistic through MPC, apply DP to the released statistic and execute one participant’s computation inside an attested environment. The assurance case still needs a separate claim and test for each layer. “Encrypted throughout” is not a specification.

Technique decision record: ED-RC-01

For the current Evidence Desk candidate, the release group records:

The production candidate rejects private fine-tuning because authorised retrieval and a deterministic template already meet the identified knowledge and structure needs, while adaptation would add a persistent artefact without controlling the dominant retrieval, citation or reviewer risks. DP-SGD, federation and privacy-enhancing cryptography do not repair those boundaries.

The decision reopens only if blinded evaluation shows a material, repeatable failure of the prompt-and-template baseline on the approved drafting task. Any proposal must then name the protected asset and observer, use a reviewed non-sensitive corpus, beat the baseline across utility and safety measures with uncertainty reported, and supply complete data, base-model, adapter, merged-export, accountant, removal and rollback lineage. Until that evidence exists, no adaptation technique enters the serving architecture.

Build identity before runtime identity

Merehaven does not promote an artefact copied from a developer workstation. A controlled build starts from reviewed source and declared dependencies, produces isolated outputs, records provenance and makes the release subject to independent admission.

NIST’s Secure Software Development Framework supplies high-level practices for secure software production and acquisition.1 SLSA version 1.2 separates source and build tracks and uses provenance to describe where, when and how an artefact was produced.2 These frameworks organise evidence; they do not make an unreviewed model safe.

The Evidence Desk path is:

1. approved source revision and dependency lock;
2. isolated build using a pinned builder identity;
3. software, model and data bills of material;
4. static, dependency, secret, licence and unsafe-serialisation checks;
5. unit, security, privacy, quality and compatibility tests;
6. canonical manifest over every serving component;
7. provenance attestation and authorised signature;
8. registry admission under an immutable identity;
9. deployment-policy verification; and
10. staged release with evidence-linked rollback.

from reference_implementation import (
    ArtefactRecord,
    sha256_bytes,
    signed_manifest_payload,
)

model_bytes = b"synthetic-model-artefact"
tokenizer_bytes = b"synthetic-tokenizer-artefact"

records = (
    ArtefactRecord(
        "model",
        len(model_bytes),
        sha256_bytes(model_bytes),
    ),
    ArtefactRecord(
        "tokenizer",
        len(tokenizer_bytes),
        sha256_bytes(tokenizer_bytes),
    ),
)

payload_for_external_signer = signed_manifest_payload(records)

assert b'"artefact_id":"model"' in payload_for_external_signer
assert b'"artefact_id":"tokenizer"' in payload_for_external_signer

The runtime starts with no ambient authority

The model process needs weights, bounded compute and an input-output channel. It does not need a shell, cloud administrator credentials, a writable model directory, unrestricted internet access or direct database permission.

The hardened runtime contract includes:

• a minimal, pinned image;
• a non-root identity;
• read-only root and model filesystems;
• a small, explicit writable scratch area with quota and expiry;
• dropped operating-system capabilities;
• a restrictive system-call profile suited to the runtime;
• no package installation during startup;
• no host socket or device access beyond the admitted accelerator;
• memory, processor, file, process and wall-time limits;
• blocked outbound network by default;
• a declared resolver and certificate trust path;
• short-lived workload credentials obtained outside the image;
• immutable configuration supplied through an approved channel; and
• health, readiness and shutdown behaviour that cannot expose prompts.

These are platform requirements, not a generic Dockerfile. Copying one container recipe across runtimes can create false assurance because isolation, accelerator access, model loading and kernel controls differ.

Unsafe model serialisation is treated as code execution risk. The loader accepts only approved formats and disables arbitrary extension or remote-code paths unless a separately reviewed component requires them. Tokenizer code, custom operators and native libraries stay inside the same supply-chain review as the weights.

Four zones, six request-data flows and a control plane

Merehaven uses four responsibility zones:

1. Workforce edge: managed staff device and user interface.
2. Application zone: gateway, session, policy, retrieval orchestration and output validation.
3. Model zone: tokenisation and generation under a workload identity.
4. Storage zone: source documents, authorised search, configuration, audit and artefact registries.

The request and case-data plane permits six flow families:

1. workforce client to gateway over the authenticated application channel;
2. gateway to the workforce identity and policy decision services;
3. application service to the retrieval service with principal, purpose and case scope;
4. retrieval service to the authorised search and document stores;
5. application service to the model service and its bounded response channel; and
6. each service to a one-way telemetry collector using a minimised schema.

Here “one-way” describes application authority: a serving workload may write allow-listed telemetry, while the collector receives no capability to initiate a serving request. Transport acknowledgements and bounded collector responses for flow control or schema rejection remain possible. Likewise, “the storage zone cannot initiate” below prohibits a new application-layer request; it does not prohibit response packets on a connection opened by an authorised caller.

The model has no direct storage path. The workforce client cannot reach the model or search index directly. The storage zone cannot initiate a request into the application. The telemetry collector cannot become a query proxy back into serving.

Bootstrap and control-plane communication is separate and explicitly allowed:

• workloads resolve names and validate time and trust material through approved infrastructure services;
• workloads authenticate to the identity, certificate, credential and secret services needed for short-lived service identity;
• the deployment controller supplies admitted configuration and immutable artefact identities; and
• approved collectors receive health and security state without becoming serving intermediaries.

These paths are mutually authenticated, destination-restricted and logged. They carry no case prompt, retrieved document or generated draft unless a separately declared protocol requires it. NIST SP 800-207A reinforces that cloud-native access decisions need application and service identities as well as user and network attributes.3

Network segmentation does not replace application authorisation. A permitted application service can still ask for the wrong case. Every storage request carries the bounded human and service context, and the resource service enforces it.

Human identity becomes corpus scope

Authentication establishes which identity presented a credential. Authorisation determines what that identity may do with a particular object for a particular purpose at that time.

NIST SP 800-207 frames zero trust around resource-focused decisions rather than implicit trust from network location.4 For the Evidence Desk, a request moves through:

1. workforce authentication;
2. issuer, audience, signature, time and client validation;
3. session and device policy;
4. current role and employment status;
5. declared processing purpose;
6. tenant and active case allocation;
7. sensitivity ceiling and document policy;
8. authorised corpus construction; and
9. a short-lived capability for the exact downstream operation.

OAuth 2.0 is an authorisation framework; OpenID Connect adds an identity layer for authentication.5 Neither supplies Merehaven’s object-level case policy. RFC 9700 updates OAuth 2.0 security practice, including privilege restriction and replay protections such as sender-constrained tokens where appropriate.6 Merehaven uses maintained libraries and central validation rather than hand-parsing a JSON Web Token.

Tokens are:

• short-lived;
• audience and resource restricted;
• free of customer prose;
• scoped to the smallest supported operation;
• protected from logging and URL leakage;
• rotated or invalidated with the session;
• rejected at exact expiry; and
• unable to widen corpus scope merely because they carry a broad role.

The retriever resolves current case allocation at request time. A role such as complaint-handler is not permission to search every complaint.

Service identity remains separate from human identity. The retrieval service authenticates the application workload while enforcing the propagated, integrity-protected human scope. It does not substitute its broader technical identity for the peer’s policy context.

Transport protection has a boundary

The current TLS best-practice record is the complete BCP 195 set, which at the edition cut-off contains RFCs 8996, 9325 and 9852.7 RFC 9852 requires a new protocol using TLS to default to TLS 1.3; the current TLS 1.3 specification is RFC 9846.8 Merehaven’s new service protocols therefore require TLS 1.3. A documented TLS 1.2 compatibility path applies only to an existing protocol integration after cryptographic and operational review. Configuration, certificate and trust-store evidence must agree with the claim.

For internal service calls, mutual authentication can bind the channel to workload identities. That requires:

• correct hostname or service-identity verification;
• controlled trust anchors;
• automated issuance and renewal;
• revocation or rapid rotation;
• mapping certificate identity to application policy;
• protection of private keys;
• failure behaviour at expiry; and
• tests against unintended trust paths.

TLS protects content and integrity in transit under its endpoint and cryptographic assumptions. It does not hide source and destination addresses, all packet length and timing patterns, endpoint plaintext, authorised misuse or information revealed by the response. TLS 1.3 early data also has replay considerations, so a consequential operation must not rely on 0-RTT without an explicit replay-safe design.

Application-layer encryption is added only for a named observer or custody boundary. It creates key-distribution, inspection, rotation, recovery and incident-response work. “Encrypt twice” is not a threat model.

Secrets stay outside prompts and images

Merehaven uses workload identity and a managed secret service for the few secrets a process needs. Secret values are never:

• committed to source;
• placed in the runtime image;
• embedded in model weights or adapters;
• included in system prompts;
• returned to the model as tool evidence;
• stored in an environment dump;
• written to ordinary telemetry; or
• exposed through a diagnostic endpoint.

The application retrieves a short-lived credential after workload authentication, holds it for the minimum period and rotates it without rebuilding the image. The capability is scoped to a service and operation. A model sees a logical tool name, never a credential.

Secret scanners cover source and build artefacts, but rotation remains necessary after exposure. Deleting a token from a later commit does not invalidate a copied credential.

Cache scope is part of authorisation

Generation systems may use response, semantic, retrieval, prefix and key-value caches. Every reused object needs a scope at least as strong as the original computation.

An Evidence Desk cache identity includes:

$$K = \operatorname{SHA\!-\!256}\!\left( \operatorname{encode}_{v1}\!\left( \begin{aligned} &\mathrm{tenant}, \mathrm{principal}, \mathrm{session}, \mathrm{purpose}, \mathrm{case\ scope}, \mathrm{sensitivity\ ceiling},\\ &\mathrm{authorisation\ epoch}, \mathrm{cache\ kind}, \mathrm{policy\ version}, \mathrm{corpus\ digest},\\ &\mathrm{model\ release}, \mathrm{prompt\ version}, \mathrm{configuration/schema\ digest}, \mathrm{input\ digest} \end{aligned} \right) \right).$$

Here, $\operatorname{encode}_{v1}$ is a versioned, canonical, length-delimited encoding of the tuple. The hash shortens a key; it does not repair a missing field or authorise reuse. Each hit revalidates current policy. Revocation, reassignment, policy update or session expiry advances the authorisation epoch and invalidates the relevant entry. Shared prefix caching is disabled for sensitive cross-user context unless the implementation can prove the reused prefix contains no user-specific or restricted material.

Cache hit, miss and timing can reveal information. High-risk endpoints consider constant-shape responses, batching or padding only after measuring the threat and operational cost.

Bound consumption before execution

Language-model cost is part of availability. A small request can trigger long context, repeated generation, recursive tools or expensive retrieval. The application sets independent ceilings for:

• request tokens;
• session tokens;
• generated tokens;
• tool calls;
• retrieval candidates and bytes;
• wall time;
• concurrency;
• retry count; and
• estimated cost.

The reference implementation exercises a five-dimensional subset: request tokens, cumulative session tokens, tool calls, wall time and estimated cost. It uses exact integers and decimal money:

from decimal import Decimal

from reference_implementation import (
    ConsumptionRequest,
    Quota,
    Usage,
    check_consumption,
)

quota = Quota(
    request_tokens=2_000,
    session_tokens=8_000,
    tool_calls=3,
    wall_time_ms=15_000,
    estimated_cost=Decimal("1.50"),
)
usage = Usage(
    session_tokens=6_500,
    tool_calls=1,
    wall_time_ms=4_000,
    estimated_cost=Decimal("0.70"),
)
requested = ConsumptionRequest(
    request_tokens=1_800,
    tool_calls=1,
    wall_time_ms=3_000,
    estimated_cost=Decimal("0.40"),
)

decision = check_consumption(quota, usage, requested)

assert not decision.allowed
assert "request token ceiling exceeded" not in decision.reasons
assert "session token ceiling exceeded" in decision.reasons

This implementation is deny-only. It does not silently truncate a case and present the partial draft as complete. A product that supports a bounded summary path models that as a separate operation with visible limitations.

A pre-execution check is insufficient once work begins. Production enforcement atomically reserves shared quota, measures actual use and cancels generation, retrieval and tools at their runtime ceilings. Generated-token, retrieval-byte, concurrency and retry limits belong in that enforcement layer even though the compact listing does not implement them.

Rate limits bind to more than an IP address. Identity, tenant, session, tool, model cost and behavioural signals help prevent distributed or denial-of-wallet abuse. Emergency limits have an owner, expiry and test because a permanent emergency rule can become an undocumented product policy.

Audit decisions without rebuilding the prompt

The complete audit model should answer who requested what scope, which policy decided, which evidence and artefact versions were used, what action was proposed and who approved it. It rarely needs the whole prompt.

The compact laboratory listing demonstrates only an allow-listed projection of event identity, time, tenant, pseudonymised person reference, principal, event type, policy code and decision. It deliberately omits evidence, artefact, action and approval references:

from datetime import UTC, datetime

from reference_implementation import RawEvent, project_audit_event

raw = RawEvent(
    event_id="event-17",
    occurred_at=datetime(2026, 7, 28, 9, 0, tzinfo=UTC),
    tenant="merehaven",
    person_ref="MH-CUST-123456",
    principal_id="staff-17",
    event_type="retrieval",
    policy_code="case-scope-pass",
    decision="allow",
    free_text="Synthetic case prose that must not survive projection.",
)

event = project_audit_event(raw, b"k" * 32)

assert not hasattr(event, "free_text")
assert event.person_pseudonym != raw.person_ref

The keyed pseudonym permits correlation under controlled key access. It remains personal data when Merehaven can reconnect it. Production key generation, storage, rotation and separation are outside this example.

The production schema adds opaque references to the requested scope, evidence, served composition, proposed action and approval where those fields apply. It does not place their full content in the event. Diagnostic content uses a different store, access group, purpose, sample policy and short retention. Incident preservation can place selected records under hold, but a hold decision is explicit and reviewed.

Release is a lineage graph

The serving record connects:

• source revision and builder identity;
• dependency, runtime and accelerator versions;
• base, adapter, tokenizer and configuration digests;
• data and corpus manifests;
• evaluation and red-team result digests;
• privacy, security, quality, fairness and accessibility gates;
• human approvals and waivers;
• deployment environment and traffic fraction;
• alert thresholds and dashboards;
• rollback target and operator; and
• evidence expiry triggers.

Staging begins with an isolated laboratory, then a staff test population, shadow comparison and bounded live traffic only where the approved use permits it. A canary release means a small traffic slice, not a synthetic privacy canary. Each stage has entry, observation, stop and rollback rules.

Rollback is tested before release. Restoring an earlier model without its tokenizer, prompt, corpus policy and schema can create a new incompatible composition. The rollback target is itself an admitted release.

An admitted Evidence Desk release can now be named without ambiguity. Its record binds build provenance, artefacts, runtime, prompt, policy, corpus, schemas, evaluation, approvals, staged traffic and rollback to the composition that actually serves.

That record is not a declaration of security. It gives the red team a bounded target: a model process with no ambient data or action authority, enumerated request and control paths, scoped identities, measured resource ceilings and evidence tied to the exact version under test.

Describe the adversary on four axes

“Test prompt injection” is too vague to reproduce. Merehaven gives every hypothesis four coordinates: knowledge, goal, surface and perturbation.

Knowledge records what the adversary can observe:

• black box: public or workforce interface, visible errors, latency and returned content;
• grey box: known model family, prompt pattern, corpus shape, tool catalogue or policy behaviour; or
• white box: weights, gradients, embeddings, source, configuration or internal traces.

These labels describe the tested access, not the actor’s identity. A peer can be a black-box tester; a supplier with diagnostic access can have white-box knowledge.

Goal names the security effect rather than the wording of the prompt: task diversion, safety-policy bypass, cross-case retrieval, data extraction, evidence corruption, unauthorised action, persistent influence, model replication, service degradation or cost amplification.

Surface identifies where the adversary’s material enters or where an observation leaves. Relevant surfaces include the chat input, uploaded files, document ingestion, retrieval corpus, metadata filters, persistent memory, tool catalogue, tool results, generated output, rendering layer, inference API, shared cache, logs and monitoring interface.

Perturbation states what changes: natural-language instructions, formatting or encoding, a token sequence, an embedding-space vector, a document or metadata field, a tool description, a memory record, request timing, query volume or resource shape.

NIST’s 2025 adversarial-machine-learning taxonomy likewise treats attacker goals, capabilities and knowledge as properties that must be stated rather than inferred from an attack name.1 Merehaven’s four axes are a case-specific record built for the Evidence Desk, not a replacement taxonomy.

MITRE ATLAS can help index hypotheses by adversary technique. Its current matrix distinguishes evidence-maturity labels including Feasible, Demonstrated and Realized; it is a threat-knowledge base, not a compliance certificate.2 Merehaven stores an ATLAS mapping separately from its own evidence state. A published laboratory result does not prove exploitation of the Evidence Desk, and a plausible path does not become an observed incident through repetition.

Direct and indirect injection have different entry conditions

A direct prompt injection is supplied through the interface by the person interacting with the model. It attempts to replace, reinterpret or reveal the application’s task and policy. An indirect prompt injection is embedded in content that the application later reads, retrieves or summarises. The person who triggers retrieval need not be the person who planted the content.

Indirect injection changes the trust problem. A case handler can issue a perfectly legitimate request while an uploaded letter, scanned image, web page, email, knowledge article or tool result contains text intended to influence the model. Research on LLM-integrated applications demonstrated this remote instruction path in controlled and real application settings.3 The result depends on retrieval, parsing, model and capability conditions; it does not mean every retrieved string controls every application. Formal prompt-injection evaluation has also modelled the attack as an application objective conflict and shown that measured defence performance changes with task, model and setup.4

Merehaven labels retrieved text as evidence, never as policy. The application constructs separate records:

from reference_implementation import (
    EvidenceEnvelope,
    EvidenceItem,
    render_model_context,
)

policy = EvidenceItem(
    item_id="policy-17",
    provenance="approved-policy-register",
    tenant="merehaven",
    sensitivity=1,
    integrity_status="verified",
    instruction_authority=True,
    content="Draft an internal evidence note. Do not propose a case outcome.",
)
case_letter = EvidenceItem(
    item_id="letter-42",
    provenance="synthetic-upload-fixture",
    tenant="merehaven",
    sensitivity=2,
    integrity_status="unverified",
    instruction_authority=False,
    content="Customer letter containing an inert red-team marker.",
)

context = render_model_context(
    EvidenceEnvelope(
        tenant="merehaven",
        policy_items=(policy,),
        evidence_items=(case_letter,),
    )
)

assert "<APPLICATION_POLICY>" in context
assert "<UNTRUSTED_EVIDENCE>" in context

Escaping and record separation preserve provenance and make testing easier. They do not force a language model to obey the outer policy. The decisive controls remain outside the model: prior authorisation, exact tool policy, schema validation, destination checks, approval and the absence of unnecessary capabilities.

A jailbreak changes the wrapper around a prohibited goal

Prompt injection and jailbreaking overlap, but the terms answer different questions. Prompt injection concerns control of an application’s intended task. A jailbreak attempts to bypass a model’s behavioural restrictions. A request can be both, either or neither.

Merehaven groups jailbreak tests by transformation rather than collecting a gallery of copied prompts:

The family view is consistent with empirical work that relates jailbreak failures to competing objectives and mismatched generalisation, although those mechanisms and results remain bounded to the evaluated models.5 Multi-turn research has separately demonstrated attacks that accumulate context rather than relying on one suffix.6 This framing prevents two common measurement errors. First, counting prompt strings overweights prolific variants of one idea. Secondly, a refusal detector can misclassify a safe explanation as compliance or a superficially polite answer as safe. The evaluator must inspect the relevant semantic effect, evidence disclosure and attempted capability, with independent review for ambiguous cases.

Automated suffixes and universal triggers are research results, not magic strings

Token-level adversarial search can use model gradients or repeated queries to find a sequence that raises the probability of a target behaviour. Wallace and peers defined universal adversarial triggers as input-agnostic token sequences that induced targeted predictions across examples in the NLP systems they evaluated.7 Zou and peers later combined greedy and gradient-based search to produce adversarial suffixes against aligned language models, including transfer experiments across prompts and models.8

The exact findings depend on model versions, tokenisers, objectives, access, decoding, system wrappers and evaluation rules. “Universal” refers to the tested distribution and setting, not every language model or future release. Transfer is an empirical result, not an architectural property.

Merehaven records the research pipeline without publishing an optimiser or reusable attack sequence:

1. choose a harmless sentinel behaviour;
2. declare model, tokeniser, access and query budget;
3. separate search prompts from held-out evaluation prompts;
4. search only in the isolated laboratory;
5. test transfer to declared candidate versions;
6. compare against benign and randomly perturbed controls;
7. report uncertainty, utility impact and failed trials;
8. store the generated sequence under red-team access; and
9. retain only a non-operational category in the book.

Comparative results also pin the attack budget, target version, chat template and scoring procedure. Benchmark work such as JailbreakBench makes these dependencies explicit; the benchmark is not a deployment certificate.9

Black-box mutation, human search and white-box gradient search create different evidence. A defence tested only against a fixed public prompt list has not been tested against an adaptive adversary who observes its decisions. The next chapter therefore separates known-fixture regression from adaptive, budget-bounded red teaming.

Token, soft-prompt and index attacks cross different boundaries

A token attack changes the discrete sequence presented to a tokeniser. It may exploit segmentation, formatting, Unicode handling, truncation or a learned response pattern. The application can preserve the exact input bytes, tokeniser version, token sequence and resulting context as evidence. Earlier white-box work such as HotFlip used gradient information to select discrete character or word changes in text classifiers; that does not make its classifier result a current chat-safety guarantee.10

A continuous model-input attack changes a soft prompt or input embedding after token lookup. Research has demonstrated such safety-alignment attacks against open models with internal access.11 This route normally requires model-internal access, control of a soft-prompt artefact or an embedding-level model interface. Access to related public base weights may support surrogate or transfer research, but it does not reveal the gradients or continuous input of a separately served target.

A vector-index attack changes the representation or records used by a retriever. The actor might submit a raw vector through an internal interface, corrupt an embedding record, manipulate indexed content or probe retrieval results. Ordinary corpus influence can change the vector index without granting access to the model’s continuous input. Conversely, a soft-prompt attack needs no vector database.

Merehaven’s public and workforce interfaces accept documents and text, not raw embedding vectors. A raw-vector attack is therefore out of scope for those interfaces. Corpus poisoning that causes a harmful vector to be generated is in scope because an actor with ingestion influence may reach that path. The distinction matters: testing an impossible raw-vector API consumes effort while an ordinary document-ingestion weakness remains open.

Normalisation also changes the evidence boundary. The team retains the original synthetic fixture, the parsed representation and the token or embedding version used in the test. It does not assume that lower-casing, character removal or re-tokenisation is a universal defence; transformations can delete legitimate meaning and attackers can adapt to the new pipeline.

Retrieval poisoning can precede the request

Retrieval-augmented generation adds two linked attack conditions:

1. the altered record must enter or influence the eligible corpus and be retrieved for the target context; and
2. the retrieved record must influence generation or a downstream decision.

The first is an ingestion, provenance, authorisation and ranking question. The second is a model and application question. Reporting only final attack success conceals which boundary failed.

PoisonedRAG demonstrated knowledge-corruption attacks in research settings by placing crafted text in a RAG knowledge base and targeting both retrieval and generation conditions.12 AgentPoison studied poisoning of agent memory or knowledge bases so a trigger retrieves an adversarial demonstration, again under particular benchmark assumptions.13 These papers establish important feasible and demonstrated paths; their headline rates cannot be carried into a bank acceptance threshold.

For the Evidence Desk, a record can become dangerous through several defects:

• an unapproved source enters the corpus;
• approved content changes without a new digest or review;
• document ownership and tenant metadata disagree;
• a revoked or superseded record remains searchable;
• a crafted passage dominates similarity ranking;
• low-integrity text outranks authoritative policy;
• an ingestion parser exposes hidden or non-visible content;
• user feedback is written back as trusted knowledge; or
• one case’s generated note becomes another case’s evidence.

Authorisation before retrieval limits which records can be selected. It does not prove their integrity. Provenance and integrity policy must also decide which eligible records can support which claim.

Tools turn influence into capability

A language model can emit text resembling a command without executing anything. Damage becomes possible when an application maps model output to a credentialled operation.

Tool-integrated agent benchmarks have shown indirect prompt injections leading to harmful or data-exfiltration objectives in experimental settings.14 The relevant lesson for Merehaven is architectural: model-generated tool arguments are untrusted proposals.

An attack chain can pass through:

1. a planted or manipulated record;
2. ingestion and indexing;
3. authorised retrieval for a legitimate case;
4. model interpretation as an instruction;
5. generation of a tool proposal;
6. application acceptance of the tool name and arguments;
7. execution under a service credential; and
8. return, persistence or disclosure of the result.

The Evidence Desk candidate exposes only evidence retrieval and internal-draft storage. Retrieval accepts a server-constructed principal, purpose, tenant and case scope. Draft storage writes a new version to the active case, requires the human reviewer to initiate the save and cannot overwrite source evidence. There is no general URL fetcher, database query, email sender, payment function or account-change tool.

This is why a model-behaviour finding and an authorisation finding receive separate severity fields. If a synthetic injection persuades the model to propose another case identifier but the resource service denies it, the model finding remains real while confidentiality is preserved in that trial. If the service accepts the case identifier from model text, the attack has crossed a deterministic boundary and warrants a different response.

Persistent memory extends the attack in time

Memory is a write path followed by a later retrieval path. A poisoned memory need not act during the session in which it is written. It may influence a future user, case or tool selection after the original content is gone.

Merehaven avoids open-ended conversational memory in the release candidate. The permitted states are:

• a short-lived session summary scoped to the same principal and case;
• a versioned internal draft that a reviewer explicitly saved;
• reviewer feedback stored as feedback, not as policy or source evidence; and
• approved corpus changes through the governed ingestion route.

Every state has provenance, tenant, case, writer, purpose, integrity class, created time, expiry and revocation state. Generated text cannot promote itself from draft to evidence. Feedback cannot silently update prompts, retrieval ranking or model weights.

The safe red-team fixtures still test attempted cross-session persistence: untrusted content requesting a memory write, a draft containing an inert marker, reassignment of a case, expiry, revocation, and retrieval by another principal. The expected result is no unauthorised write and no later cross-boundary retrieval.

Model theft, side channels and resource attacks use the interface differently

Not every attack tries to alter a generated answer.

Build a safe attack-chain library

Merehaven’s red-team library stores hypotheses and inert fixtures, not a warehouse of reusable harmful prompts. Each record has:

The initial fictional register contains the following bounded cases:

“Expected” is not a test result. The register gains an observation only after independent execution against an immutable candidate, with logs and artefact identities. A pass means the named fixture did not cross the named boundary under the tested conditions. It does not certify every paraphrase, adaptive attack or future composition.

An Executed laboratory observation additionally records target identity, fixture and protocol digests, timestamp, raw result, reviewer and evidence location. A Documented external operation requires a traceable external source; it is not inferred from a laboratory result. No local evidence state is silently converted into an ATLAS maturity label.

Severity follows the deepest boundary crossed

Merehaven scores impact using the capability reached and the asset involved, then records exploitability separately. The following distinctions prevent prompt theatrics from displacing system risk:

• Model deviation: generated text leaves the intended behavioural boundary, but no restricted data or operation is reached.
• Proposal boundary failure: the application accepts an invalid structured proposal, but a downstream resource or approval gate blocks execution.
• Authorisation failure: an unauthorised record or operation is made available to the application.
• Execution failure: a restricted modification or transaction occurs.
• Persistence failure: corrupted state influences a later request or user.
• Availability failure: a declared service or cost threshold is breached.

A low-impact fixture can expose a high-value structural weakness. Conversely, an alarming string can have limited operational impact when every capability boundary holds. Both findings are retained, but they are not conflated.

The finding record preserves unsuccessful paths as well. A denial at the resource service proves that one gate operated for one case; it also reveals which earlier gates allowed the proposal to travel that far. Defence work can then reduce both likelihood and blast radius.

The attack register now asks a harder question than “did the prompt work?” For each high-priority hypothesis it states which actor changed which object, under which access, across which trust boundaries, and whether the path reached read, disclose, modify, transact or consume.

Unfinished paths do not disappear. They end at a named deterministic boundary with reproducible evidence, or at an explicit residual-risk decision. That is the material needed to choose controls, construct regressions and decide whether an unchanged serving composition can advance.

Remove power before adding judgement

OWASP separates three contributors to excessive agency: too much functionality, too much permission and too much autonomy.1 The distinction gives the design team three different ways to reduce harm.

Removing a function is stronger than describing it as forbidden in a prompt. If no customer-message operation is exposed to the Evidence Desk workload, persuasive text cannot select that operation through this application. This claim concerns only the declared composition. It says nothing about other Merehaven systems.

Least privilege applies to the human, workload, tool, corpus, operation, arguments, destination, validity interval and resource budget. Complete mediation means checking access again at the resource boundary, not reusing a decision from an earlier chat turn. These principles pre-date language models and remain directly applicable.23 OAuth security guidance likewise calls for access-token privilege to be restricted and for the resource server to verify the resource and action on every request.4

The safest high-impact tool is the one the use case does not need. When a tool is necessary, it receives a narrow capability rather than the application’s ambient identity. When an operation can cause a material consequence, the executor requires a separate approval record rather than asking the model whether the action looks acceptable.

The model proposes; the resource service decides

Generated output is untrusted input to the component that consumes it. A JSON object can be structurally valid and still name an unauthorised case. An authorised case can still carry an invalid document identifier, excessive result count or unsafe destination. Output handling and authorisation are therefore different checks.5

Each operation has a closed schema. Unknown fields fail rather than disappear. The contract names:

• an exact tool and operation;
• tenant, purpose and case derived from trusted state;
• required arguments with exact types and bounded values;
• a named destination where one exists;
• an operation-specific impact ceiling;
• a short validity interval;
• a unique request identity and replay rule; and
• the policy and schema versions used for the decision.

JSON Schema can validate structure and types, but it is not an authorisation language.6 Business policy still checks current case allocation, document status, sensitivity, destination ownership, result limits, revocation and state transitions. Rich Authorization Requests illustrate why a coarse scope can be insufficient when the resource, action and transaction details matter, although Merehaven’s local contract is not an implementation of that RFC.7

The executable laboratory exposes the boundary with one permitted operation:

from datetime import UTC, datetime, timedelta

from reference_implementation import (
    ArgumentRule,
    CapabilityGrant,
    Principal,
    ResourceRecord,
    ToolCall,
    authorise_tool_call,
)

now = datetime(2026, 7, 28, 11, 0, tzinfo=UTC)
principal = Principal(
    principal_id="staff-17",
    tenant="merehaven",
    case_ids=frozenset({"MH-CASE-100042"}),
    sensitivity_ceiling=2,
)
resource = ResourceRecord(
    resource_id="MH-DOC-000017",
    tenant="merehaven",
    case_id="MH-CASE-100042",
    allowed_purpose_ids=frozenset({"complaint-evidence-review"}),
    active=True,
    impact_per_unit=1,
    state_version="document-state-6",
)
grant = CapabilityGrant(
    grant_id="grant-evidence-read-17",
    policy_id="case-read-policy",
    policy_version="7.2.0",
    schema_version="4.0.0",
    principal_id="staff-17",
    tenant="merehaven",
    purpose_id="complaint-evidence-review",
    tool_name="case-evidence",
    operation="read-passages",
    destination="evidence-context",
    case_ids=frozenset({"MH-CASE-100042"}),
    argument_rules=(
        ArgumentRule(
            "document_id",
            str,
            minimum_length=13,
            maximum_length=13,
            pattern=r"MH-DOC-[0-9]{6}",
            allowed_values=("MH-DOC-000017",),
        ),
        ArgumentRule(
            "maximum_passages",
            int,
            minimum_value=1,
            maximum_value=5,
        ),
    ),
    resource_argument="document_id",
    impact_argument="maximum_passages",
    maximum_impact=5,
    not_before=now - timedelta(minutes=1),
    expires_at=now + timedelta(minutes=4),
)

allowed = ToolCall(
    request_id="MH-REQUEST-000201",
    tool_name="case-evidence",
    operation="read-passages",
    tenant="merehaven",
    purpose_id="complaint-evidence-review",
    case_id="MH-CASE-100042",
    arguments=(
        ("document_id", "MH-DOC-000017"),
        ("maximum_passages", 3),
    ),
)
foreign_case = ToolCall(
    request_id="MH-REQUEST-000202",
    tool_name="case-evidence",
    operation="read-passages",
    tenant="merehaven",
    purpose_id="complaint-evidence-review",
    case_id="MH-CASE-999999",
    arguments=(
        ("document_id", "MH-DOC-000017"),
        ("maximum_passages", 3),
    ),
)

permitted = authorise_tool_call(
    principal,
    allowed,
    resource,
    (grant,),
    now,
)
assert permitted.allowed
assert permitted.derived_impact == 3
assert permitted.authorised_payload is not None

denied = authorise_tool_call(
    principal,
    foreign_case,
    resource,
    (grant,),
    now,
)
assert not denied.allowed
assert denied.authorised_payload is None

The example first rejects derived security-record classes and exact records with missing declared fields, then copies validated primitive fields into stable internal records. It checks exact field names, exact scalar runtime types by identity rather than overloadable equality, string grammar and length, a non-branching pattern subset with exact repetition only, an implementation-sized integer domain, authenticated principal, tenant, purpose, case, current resource state, fixed-UTC grant time and versioned policy. An immutable grant tuple is measured directly; a mutable grant list is copied only through entry 65, so the 64-entry ceiling bounds snapshot work as well as acceptance.

An escape-aware lexical scan rejects variable repetition and ambiguous character-class set syntax independently of Python’s compiled-pattern cache. The grammar also rejects an unescaped ] in the literal-first class position, including after a leading ^; \] is the accepted literal spelling. Warning-strict compilation supplies a second validity check. Scalar strings containing UTF-16 surrogate code points are also rejected; without that rule, a scalar character and a manually assembled surrogate pair can collapse to the same ASCII-escaped JSON bytes.

Impact is not supplied by the caller: it is the trusted resource weight multiplied by the validated passage count. An allow decision returns immutable canonical bytes binding the request, grant, resource case and state, arguments and derived impact. Passing this function still does not cause a read.

The teaching boundary does not authenticate grant issuance, sign policy distribution, query live retention or sensitivity records, or persist replay state. A production resource service must consume the returned bytes, repeat current object-level checks and write its decision evidence. It must never authorise one object and execute a later mutable request.

The receiving boundary also determines how a value is interpreted. Generated text is never interpolated into a shell command, query language, file path, HTML fragment or destination URL. A database adapter uses parameter binding. A renderer treats draft text as text. A document service selects server-known identifiers. A network client resolves an allow-listed destination independently of generated prose.

Approval is for one immutable proposal

“Human in the loop” describes no control unless the person has authority, sufficient evidence and time, sees the exact proposed effect, and can refuse it before execution. Approval of a summary while hidden arguments remain mutable is not approval of the action.

For a separately governed future workflow, Merehaven would bind approval to:

• the authenticated proposer and approver;
• required segregation of duties;
• tenant, purpose, operation, resource and destination;
• every canonical argument and the policy-classified impact;
• schema and policy versions;
• the representation displayed to the approver;
• approval time and exclusive expiry;
• one-time consumption or an idempotency rule; and
• the execution and audit identifiers.

A digest provides a collision-resistant identity check for canonical bytes. It does not prove that an authorised person reviewed those bytes, understood their display or prevented replay.8 The reference laboratory therefore checks both the digest and the surrounding approval record:

from datetime import UTC, datetime, timedelta

from reference_implementation import (
    ActionPolicy,
    Approval,
    ApprovalAuthority,
    ApprovalState,
    ArgumentRule,
    Principal,
    ProposedAction,
    ResourceRecord,
    action_digest,
    authorise_execution,
)

now = datetime(2026, 7, 28, 11, 15, tzinfo=UTC)
proposer = Principal(
    principal_id="staff-17",
    tenant="merehaven",
    case_ids=frozenset({"MH-CASE-100042"}),
    sensitivity_ceiling=2,
)
resource = ResourceRecord(
    resource_id="MH-CASE-100042",
    tenant="merehaven",
    case_id="MH-CASE-100042",
    allowed_purpose_ids=frozenset({"complaint-evidence-review"}),
    active=True,
    impact_per_unit=1,
    state_version="case-state-12",
)
policy = ActionPolicy(
    policy_id="draft-review-policy",
    policy_version="3.0.0",
    schema_version="2.0.0",
    tenant="merehaven",
    purpose_id="complaint-evidence-review",
    operation="place-draft-in-review-queue",
    destination="complaints-quality-review",
    argument_rules=(
        ArgumentRule(
            "draft_digest",
            str,
            minimum_length=64,
            maximum_length=64,
            pattern=r"[0-9a-f]{64}",
        ),
        ArgumentRule(
            "review_mode",
            str,
            allowed_values=("evidence-quality",),
        ),
    ),
    impact_class="internal-review",
    classified_impact=1,
    requires_segregation=True,
    approval_ttl=timedelta(minutes=5),
)
authority = ApprovalAuthority(
    authority_id="MH-AUTHORITY-000004",
    approver_id="reviewer-8",
    tenant="merehaven",
    purpose_id=policy.purpose_id,
    operation=policy.operation,
    destination=policy.destination,
    resource_ids=frozenset({resource.resource_id}),
    policy_id=policy.policy_id,
    policy_version=policy.policy_version,
    schema_version=policy.schema_version,
    maximum_impact=1,
    not_before=now - timedelta(minutes=10),
    expires_at=now + timedelta(minutes=10),
)
proposal = ProposedAction(
    action_id="MH-ACTION-000031",
    tenant="merehaven",
    proposer_id="staff-17",
    purpose_id=policy.purpose_id,
    operation="place-draft-in-review-queue",
    resource_id=resource.resource_id,
    destination=policy.destination,
    arguments=(
        ("draft_digest", "3" * 64),
        ("review_mode", "evidence-quality"),
    ),
)
approval = Approval(
    approval_id="MH-APPROVAL-000009",
    tenant="merehaven",
    approver_id="reviewer-8",
    authority_id=authority.authority_id,
    policy_id=policy.policy_id,
    policy_version=policy.policy_version,
    schema_version=policy.schema_version,
    action_digest=action_digest(proposal, policy, resource),
    approved_at=now,
    expires_at=now + timedelta(minutes=5),
)
state = ApprovalState(
    consumed_approval_ids=frozenset(),
    revoked_approval_ids=frozenset(),
    revoked_authority_ids=frozenset(),
)

decision = authorise_execution(
    proposer,
    proposal,
    resource,
    approval,
    policy,
    authority,
    state,
    now,
)
assert decision.allowed
assert decision.authorised_payload is not None
assert approval.approval_id in decision.next_state.consumed_approval_ids

changed = ProposedAction(
    action_id=proposal.action_id,
    tenant=proposal.tenant,
    proposer_id=proposal.proposer_id,
    purpose_id=proposal.purpose_id,
    operation=proposal.operation,
    resource_id=proposal.resource_id,
    destination=proposal.destination,
    arguments=(
        ("draft_digest", "4" * 64),
        ("review_mode", "evidence-quality"),
    ),
)
assert not authorise_execution(
    proposer,
    changed,
    resource,
    approval,
    policy,
    authority,
    state,
    now,
).allowed
assert not authorise_execution(
    proposer,
    proposal,
    resource,
    approval,
    policy,
    authority,
    decision.next_state,
    now,
).allowed

This synthetic action only places an internal draft into a review queue. It does not send a customer communication or decide a complaint. The proposer cannot set impact or disable segregation. Trusted policy fixes both; a separate current authority record limits the approver by tenant, purpose, operation, destination, resource, version and impact. Exact record-class checks stop a supplied object changing meaning between validation and serialisation, while an exact but structurally incomplete record receives a deliberate denial rather than leaking an attribute error. Scalar tuple arguments prevent nested mutation; scalar types are admitted by identity, and strings with surrogate code points are excluded before canonicalisation. The canonical bytes bind the resource’s case identifier and state version as well as the action. Times must use the fixed UTC representation, and approval lifetime is compared after interval validation without adding to a supplied timestamp. The executor receives the same bytes whose digest was approved. The returned state consumes the approval, so replay with that state is denied.

The laboratory still does not authenticate issuance, prove that the human display matched the canonical bytes or persist consumption and dispatch in one durable transaction. Its finite in-memory state denies a new approval before crossing its capacity, and a malformed state yields no reusable replacement. A production executor needs a durable retention rule and must make state transition and effect atomic; reusing an old valid state snapshot would defeat the pure demonstration. Those omissions are explicit release gaps, not work delegated to the model.

Put each control where its failure begins

Control accumulation is not defence in depth. Two filters trained on similar data can fail together, while an extra parser or remote call can create new attack surface. A useful layer addresses a distinct failure, has an owner and leaves evidence at the point where it acts.

The control-to-test record connects a Chapter 8 hypothesis to a terminal capability. The completed record below is a wholly synthetic teaching result. Its identifiers, counts and outcomes are not Merehaven production measurements or evidence from any real organisation.

The fixture and evidence-summary JSON records are retained with Appendix C so their published digests resolve to exact bytes. The record prevents a detector’s favourable score from obscuring a permission defect. It also prevents a contained model failure from disappearing inside a single green system result.

Detectors route uncertainty; they do not settle authority

An input or output detector applies a threshold to a score. Its errors depend on language, domain, context length, prevalence, threshold, attack adaptation and distribution shift. A global accuracy figure hides those dependencies.

Prompt-injection benchmarks show that effectiveness varies across attacks, defences, models and tasks.9 Defence-aware studies have bypassed multiple evaluated indirect-injection defences in their reported settings.10 This is a reason to run adaptive evaluation, not a claim that every detector always fails. Structured-query research is equally bounded: StruQ combines a secure front end with a specially trained model, so its reported resistance belongs to that composition rather than to delimiters alone.11

For each detector, Merehaven records:

• the input surface and construct it is meant to detect;
• model, threshold and artefact identity;
• languages, document classes and context lengths tested;
• benign, adversarial and difficult-legitimate sampling frames;
• true-positive and false-negative rates;
• false-positive rate and precision at a stated prevalence where meaningful;
• subgroup, hard-negative and abstention results;
• adaptive attack access and budget;
• p50, p95 and p99 latency;
• resource and monetary cost with price date;
• behaviour on timeout or dependency loss; and
• the deterministic control that contains a miss.

Quoted policy, customer complaints, multilingual text, security discussions and imperative language belong in the benign set. Otherwise, the easiest way to improve apparent attack detection is to make ordinary banking work impossible.

Reusing the generator as its own evaluator does not make the judgement independent. Shared training, prompt structure, context and failure modes can correlate the two outputs. Self-critique may be useful as an experimental feature, but release evidence must measure the joint system. An ensemble likewise needs a defined decision rule and evidence about dependence; “majority vote” has no obvious meaning for unconstrained free-form drafts.12

Adversarial training has a declared mathematical boundary

For a continuous classifier illustration, let the non-empty input domain be the closed box $\mathcal X=[\ell,u]\subset\mathbb R^d$, with $\ell_j\le u_j$ for every coordinate. Let $\Theta\ne\varnothing$, let $D$ be a declared distribution over $\mathcal X\times\mathcal Y$, and fix $\varepsilon\ge0$. For $x\in\mathcal X$, define:13

$$S_\varepsilon(x) = \left\{ \delta\in\mathbb R^d: \|\delta\|_\infty\le\varepsilon \ \text{and}\ x+\delta\in\mathcal X \right\}.$$

The set contains $0$, so it is non-empty; it is also compact and convex. Assume that, for each $\theta$, the map $\delta\mapsto\mathcal L(f_\theta(x+\delta),y)$ is real-valued and continuous on $S_\varepsilon(x)$. The inner maximum then exists. Also assume that the resulting maximum is measurable in $(x,y)$ and integrable under $D$. Define:

$$J_\varepsilon(\theta) = \mathbb E_{(x,y)\sim D} \left[ \max_{\delta\in S_\varepsilon(x)} \mathcal L\!\left(f_\theta(x+\delta),y\right) \right], \qquad \inf_{\theta\in\Theta}J_\varepsilon(\theta).$$

The expression is commonly called a min-max objective. The outer operator is an infimum because a minimising parameter need not exist. A minimum may replace it only after suitable attainment conditions, such as compactness of $\Theta$ and lower semicontinuity of $J_\varepsilon$, have been established. If continuity or compactness of the inner problem is unavailable, use a supremum rather than claiming that a maximum is attained.

For this $L_\infty$ threat model, initialise $\delta^{(0)}\in S_\varepsilon(x)$, commonly at zero, and define:

$$\delta^{(k+1)} = \Pi^{(2)}_{S_\varepsilon(x)} \left( \delta^{(k)} + \eta\, \operatorname{sign} \nabla_\delta \mathcal L\!\left( f_\theta(x+\delta^{(k)}),y \right) \right), \qquad \eta>0,$$

where $\Pi^{(2)}_{S_\varepsilon(x)}$ is Euclidean projection onto the declared compact convex set and $\operatorname{sign}(0)=0$. For this box-constrained set, projection is unique and componentwise:

$$\left[ \Pi^{(2)}_{S_\varepsilon(x)}(z) \right]_j = \operatorname{clip} \left( z_j,\, \max\{-\varepsilon,\ell_j-x_j\},\, \min\{\varepsilon,u_j-x_j\} \right).$$

The update assumes that the gradient exists at the evaluated point. A non-smooth implementation needs a declared subgradient or another search rule; a selected subgradient need not produce ascent. Finite projected-gradient iterations approximate the inner search. They do not prove that the maximum was found and do not create a robustness certificate.

The zero-radius case is explicit. If $\varepsilon=0$, then $S_0(x)=\{0\}$, every projected iterate remains zero and:

$$J_0(\theta) = \mathbb E_{(x,y)\sim D} \left[ \mathcal L\!\left(f_\theta(x),y\right) \right].$$

There is then no adversarial perturbation search. This is a useful implementation boundary test, not evidence of adversarial robustness. The construction belongs to a declared finite-dimensional continuous domain; it does not specify a valid perturbation set for language.

For an Evidence Desk system, every symbol would need a new operational meaning. Is $x$ a token sequence, conversation, retrieved document, complete context or tool trajectory? Which transformations preserve the complaint-handling task? What is the correct label for an open-ended draft? Which loss captures disclosure, task diversion or an unauthorised effect? What access and budget does the inner search receive? Which attack families remain held out?

Without those definitions, “adversarial training” means only that selected examples were included during training. PGD evidence for norm-bounded continuous classifier inputs does not establish resistance to semantic jailbreaks, indirect injection, poisoned retrieval or tool misuse.

Named techniques retain their original domains:

Language augmentation deserves special care in banking prose. A synonym replacement can change a defined policy term. Back-translation can alter an amount, deadline or negation and can disclose text to another processor. Word deletion can erase the exception that makes a sentence true. Every augmented case therefore needs semantic and data-flow review before it becomes training or evaluation evidence.

A certificate names the certified object, output, perturbation set, metric, radius, model identity, assumptions, confidence, abstentions and excluded components. “Certified” without that domain is a label without a claim.

Red teaming is a controlled evidence cycle

Red teaming is neither an unrestricted attack session nor a certificate. NIST’s Generative AI Profile treats the practice as evolving and ties findings to governance, measurement history and continuing review.20 NIST’s adversarial machine-learning taxonomy emphasises adaptive evaluation and records that stronger attacks have defeated many proposed mitigations.21 The NCSC guidelines place testing and remediation across design, development, deployment, operation and maintenance.22

Merehaven uses an eleven-state cycle:

1. Hypothesise: name the asset, actor, preconditions, trust boundaries and terminal capability.
2. Authorise: approve the target composition, safe fixtures, isolated environment, tester identities, access, budget, stop conditions and evidence handling.
3. Execute: use synthetic records and inert effects against the exact candidate.
4. Capture: retain inputs or restricted digests, outputs, proposals, policy decisions, versions, timings, costs and raw evaluator records.
5. Reproduce: confirm the finding and separate model behaviour from parsing, rendering, authorisation or resource-control failure.
6. Triage: assess plausible impact, prerequisites, affected scope, detectability and uncertainty.
7. Remediate: prefer capability removal or deterministic containment before behavioural tuning.
8. Regress: turn the safe finding into a fixed versioned test with an exact expected boundary.
9. Re-test adaptively: use held-out, defence-aware cases and an evaluator independent of the remediation path.
10. Decide: record avoid, mitigate, transfer or accept, with accountable owner, rationale, evidence and expiry.
11. Monitor: reopen the hypothesis after a material change or relevant new evidence.

Adaptive testing means the authorised evaluator can learn relevant defence details and adjust within a declared access and budget model. Apparent classifier robustness can result from gradient masking, and no single adaptive method is sufficient for every defence.2324 For tool-enabled language models, the lesson is to inspect the full chain and design cases around the actual defence, without publishing operational payloads.

Fixed regressions and held-out adaptive cases serve different purposes. A fixed case proves that a known boundary has not obviously re-opened. A held-out case tests whether the remediation merely recognises a fixture. Evaluator independence matters because the same model, prompt or dataset used to create the mitigation can reproduce its blind spots.

Every authorised trial receives a stable identifier before its outcome is known. No result is silently removed, and several mutations of one underlying scenario are clustered or aggregated rather than presented as independent discoveries.

Measure security, utility and operating cost together

Benchmarks such as HarmBench and JailbreakBench demonstrate the value of declaring targets, attacks, scoring, templates and cost.2526 They remain benchmark frameworks, not Evidence Desk release certificates.

Let $A$ be the attempted population. The predeclared adjudication partitions it into five mutually exclusive classes:

• $S$: valid, scorable trials that meet the success rubric;
• $F$: valid, scorable trials that do not;
• $O$: valid trials that time out before a terminal outcome can be established;
• $U$: valid trials whose result remains indeterminate after the declared adjudication; and
• $I$: invalid trials that violated the protocol or fixture contract and therefore do not support an inference about the candidate.

Thus:

$$N_A=N_S+N_F+N_O+N_U+N_I.$$

An invalid result is not an attack failure. Its trial identifier, reason, adjudicator and evidence remain in the attempted-trial record. A replacement run receives a new identifier. A trial must not be reclassified as invalid because its outcome is inconvenient.

A timeout is classified as success or failure when the predeclared rubric and retained evidence establish the terminal effect. A confirmed fail-closed denial, for example, can be a failure for a disclosure attack while remaining a success for a separately defined availability attack. Only unresolved timeouts remain in $O$.

The completed-trial point estimate is:

$$\widehat{\mathrm{ASR}}_{\mathrm{scorable}} = \frac{N_S}{N_S+N_F}, \qquad N_S+N_F>0.$$

It is conditional on obtaining a scorable result and must be labelled accordingly. Let $N_V=N_S+N_F+N_O+N_U$. The report also gives the unresolved-outcome sensitivity range:

$$\frac{N_S}{N_V} \le \mathrm{ASR}_{\mathrm{sensitivity}} \le \frac{N_S+N_O+N_U}{N_V}, \qquad N_V>0.$$

The lower endpoint treats every unresolved valid trial as failure; the upper endpoint treats every such trial as success. This is not a confidence interval. Report attempted count $N_A$, invalid count $N_I$, every invalidity reason, valid coverage $N_V/N_A$, scorable coverage $(N_S+N_F)/N_V$, the completed-trial estimate and the sensitivity range together.

The rubric distinguishes model text, a proposed call, an accepted call and a completed system effect. Apply the status rule separately to each layer. Trial unit, severity, access, query budget, stochastic samples and adjudication are fixed before execution. For a prohibited disclosure or action class, an unresolved timeout or indeterminate result without retained evidence of fail-closed containment holds release even when the completed-trial estimate is zero.

For paired baseline and defended candidates:

$$\Delta_{\mathrm{ASR}} = \widehat{\mathrm{ASR}}_{\mathrm{baseline}} - \widehat{\mathrm{ASR}}_{\mathrm{defended}}.$$

Relative reduction is:

$$R_{\mathrm{ASR}} = \frac{ \widehat{\mathrm{ASR}}_{\mathrm{baseline}} - \widehat{\mathrm{ASR}}_{\mathrm{defended}} }{ \widehat{\mathrm{ASR}}_{\mathrm{baseline}} },$$

only when $\widehat{\mathrm{ASR}}_{\mathrm{baseline}}>0$. At a zero baseline it is undefined, and it may be negative when the defended candidate performs worse. Both component rates and the absolute difference remain in the report. If the model, prompt, tool set or evaluator changed, the result is a full-system comparison rather than evidence about one isolated defence.

For a non-empty representative benign set $B$:

$$\widehat{\mathrm{FPR}} = \frac{ \sum_{i\in B} \mathbf{1}[ \text{legitimate trial blocked or escalated as attack} ] }{ |B| }, \qquad |B|>0.$$

The detector threshold, sampling frame, numerator, denominator and confidence interval travel with the value. Wilson intervals are suitable for a predeclared binomial-proportion analysis, including zero observed successes, where the upper bound remains above zero.27 Repeated stochastic samples, evaluator disagreement and distribution shift add uncertainties that a binomial interval alone does not capture.

Clean utility measures task completion: authorised-evidence precision and recall, citation and case-scope correctness, schema-valid draft rate, unsupported claims, human correction or rejection, time to a usable internal draft, accessibility and reviewer comprehension. A detector that refuses almost every legitimate complaint has not created a useful service.

Latency is reported at p50, p95 and p99 for the end-to-end path and its retrieval, policy, model, detector and tool components. Cold and warm paths, timeouts and retries are separate. Resource reporting precedes currency: tokens, model and detector calls, retrievals, tool calls, processor time, storage, telemetry and reviewer time. Any monetary estimate names currency, price basis and date.

There is no universal ASR, FPR or retest cadence. Merehaven’s acceptance rules depend on impact, plausible threat, sample power, review capacity and risk appetite. Cross-customer disclosure and unauthorised external action remain prohibited outcome classes; zero observed events do not prove zero possible risk.

Promotion gate

Candidate ED-RC-01 can move to the next assurance state only when:

1. every high-impact function outside the use case is absent from the Evidence Desk workload;
2. each remaining retrieval or tool operation has a closed schema, current capability grant, object-level policy check, bounded impact and fail-closed dependency behaviour;
3. generated values are handled as untrusted input by their destination;
4. any required approval binds the exact immutable action, authorised approver, validity interval and consumption rule;
5. every high-priority attack hypothesis maps to an owner, control, safe test, expected boundary, evidence record and expiry;
6. known findings have fixed regressions and receive held-out adaptive re-testing;
7. probabilistic controls report ASR, false-positive burden, clean utility, latency, resource cost and uncertainty for the exact candidate;
8. deterministic containment tests pass for every prohibited disclosure or action class;
9. residual risks have an explicit avoid, mitigate, transfer or accept decision by a person with authority; and
10. the protected evidence and telemetry design does not create a new unrestricted corpus.

A failed detector can coexist with a contained system. A polite model can coexist with an unsafe grant. The release decision follows the latter boundary first, then asks whether the remaining behavioural failure and operating burden are acceptable under measured evidence.

Follow the whole pathway

Bias is not a substance found only in training data. It is a mismatch between the system, its measurements and the social setting in which consequences arise. The mismatch can enter at several points.12

Representation bias appears when the development or test data do not adequately cover affected people or conditions. For the Evidence Desk, coverage includes complaint channels, assistive formats, language varieties, case complexity, document quality and customers whose records follow uncommon paths. A large corpus can still be sparse where the harm is concentrated.

Historical bias remains when recorded practice reflects an inequality that should not be repeated. Training on accepted past drafts can reproduce the writing and review habits that created the archive. Agreement with history is not evidence of fairness.

Measurement bias arises when the observed variable is a poor or uneven proxy for the intended construct. Reviewer acceptance, for example, can mean “accurate and useful”, “good enough under time pressure” or merely “not edited in the captured system”. Customer satisfaction can be shaped by channel access, expectations and whether a response was understandable.

Aggregation bias occurs when one model, prompt or threshold is used across populations whose language or case processes differ in relevant ways. Splitting every small group into a separate model is not the automatic remedy. That can reduce sample size, increase operational complexity and expose sensitive group membership. The question is whether the shared representation and procedure remain fit for the declared task.

Evaluation bias enters when the benchmark omits consequential conditions or measures the wrong output. Exact-match accuracy will not reveal a missing mitigating passage, a harsher register or an unnecessary escalation. An overall average can conceal a small group with a wide uncertainty interval and a materially different failure pattern.

Deployment and feedback bias appears after release. Reviewers may over-trust polished drafts, correct some case types more carefully than others, or avoid a slow escalation route. If accepted drafts become the next evaluation or adaptation set, those behaviours enter the evidence loop.

Merehaven records where each observation arose. A disparity in draft wording does not establish that the base model caused it. Retrieval coverage, document quality, prompt construction, output validation, reviewer practice and the upstream reason record are alternative or interacting causes. Remediation follows the cause that the evidence supports.

Choose the question before the measure

Formal fairness criteria describe different relationships among group attribute $A$, observed target $Y$, binary output $\widehat{Y}$ and score $S$. They do not decide which relationship is just. That choice depends on the harm, use, population, data quality and applicable law.