Verifier-Bound Communication for LLM Agents: Certified Bounds on Covert Signaling

TL;DR

This paper introduces CLBC, a protocol for verifying communication bounds in LLM agents, ensuring policy compliance and limiting covert signaling through certified proofs and verifier-bound envelopes.

Contribution

It presents a novel verifier-bound communication protocol with formal guarantees on information leakage and adaptive composition, enhancing security in LLM agent coordination.

Findings

Aggregate evaluation meets all thresholds

Bounded advantage of decoders at 0.0000

Stress tests remain below attacker thresholds

Abstract

Colluding language-model agents can hide coordination in messages that remain policy-compliant at the surface level. We present CLBC, a protocol where generation and admission are separated: a message is admitted to transcript state only if a small verifier accepts a proof-bound envelope under a pinned predicate $\Pi$. The predicate binds policy hash, public randomness schedule, transcript chaining, latent schema constraints, canonical metadata/tool fields, and deterministic rejection codes. We show how this protocol yields an upper bound on transcript leakage in terms of latent leakage plus explicit residual channels, derive adaptive composition guarantees, and state a semantic lower bound when policy-valid alternatives remain choosable. We report extensive empirically grounded evidence: aggregate evaluation satisfies all prespecified thresholds; strict lane decoder advantage is bounded at 0.0000 with MI proxy 0.0636; adaptive-colluder stress tests remain below attacker thresholds; and baseline separation shows large gaps between reject-by-default semantics and audit-only controls. We further quantify operational tradeoffs. Strict full-proof mode has median turn latency 27.53s (p95 28.08s), while sampled proving reduces non-proved-turn latency to 0.327ms. The central finding is that bottlenecks alone are insufficient: security claims depend on verifiable admission semantics that are online, deterministic, and fail-closed.