Indeterminate Emergence

1. Motivation

Traditional security models assume the existence of secrets and attempt to prevent their disclosure. Encryption conceals content. Access control prevents retrieval. Both approaches share a structural defect: they confirm that something worth protecting is present. A locked door announces a room worth entering. An encrypted payload announces a secret worth extracting. A refusal to execute announces a capability worth probing.

AI agent systems that act in the real world introduce a new attack surface. An agent with access to enterprise tools, APIs, and databases constitutes a capability profile. An adversary who can infer that profile through observation, whether by cataloguing successful actions, provoking refusals, or measuring timing variations, gains targeting information without ever breaking encryption.

This paper proposes a different starting point. Instead of hiding secrets that detectably exist, the framework builds systems in which meaningful information, capabilities, and effects do not exist outside the exact execution context where they are authorized.

2. Core Definition

A system exhibits indeterminate emergence with respect to a secret set S and an adversary A if A cannot distinguish, with advantage greater than epsilon, between three states: (1) the system possesses and is executing on elements of S, (2) the system possesses elements of S but is not executing on them, and (3) the system does not possess elements of S. The indistinguishability holds across all observation strategies available to A within the defined adversary model.

This is a stronger guarantee than semantic security under chosen-ciphertext attack. Semantic security protects the content of a message given that the adversary knows a message exists. Indeterminate emergence protects the existence of the capability itself.

3. Core Results

3.1 Absorptive Execution

When an adversary probes a system with indeterminate emergence properties, the system does not refuse, throw errors, or vary its observable behavior. It continues producing output that is statistically indistinguishable from normal operation while halting all real computation. The adversary observing the channel cannot determine whether the system is executing, inert, or absent.

Absorptive execution requires three engineering properties: fixed-format responses (all output conforms to a single template regardless of internal state), timing padding (response latency is drawn from a fixed distribution, not from actual computation time), and state suppression (no side effects propagate outside the execution boundary during absorption).

3.2 Leakage Budget

Every interaction between an adversary and a system leaks a small amount of information about the system's internal state. Over many interactions, these leakages accumulate. The leakage budget formalizes this accumulation using composition theorems from differential privacy: each interaction consumes an epsilon-delta quantum of budget, and the total information an adversary can extract across all interactions is bounded by the sum of those quanta.

When the budget reaches its threshold, absorptive execution activates automatically and irreversibly for that session. The adversary cannot extract additional information by changing strategy, increasing interaction volume, or applying adaptive queries after the threshold is reached.

3.3 Pufferfish Indistinguishability Proof

The formal security proof uses the Pufferfish privacy framework, which allows explicit specification of the secret pairs (the hypothesis pairs the adversary is trying to distinguish) and the data generating model (how observations are produced). For each secret pair in S, the proof shows that the adversary's distinguishing advantage is bounded by epsilon under composition with the leakage budget constraint.

Four adversary models are analyzed in the full preprint: Level 1 (network observer, sees only channel traffic), Level 2 (active adversary, can inject and modify messages), Level 3 (side-channel adversary, has access to timing and metadata), and Level 4 (insider adversary, has partial system access). The formal guarantee in version 1.0 covers Level 1 only.

4. Measured Variables

• Transcript indistinguishability (epsilon, delta): the distinguishing advantage bound for a Level 1 adversary observing channel traffic across all interaction strategies
• Adversary advantage bound: the maximum probability of correct hypothesis discrimination after budget exhaustion
• Privacy budget depletion rate: quanta consumed per interaction type, determining the interaction limit before absorption triggers
• Classifier accuracy against channel-shaped responses: empirical measure of how well a machine learning classifier can distinguish absorptive from live responses on held-out channel captures

5. Limitations

The formal guarantees in version 1.0 cover Level 1 adversaries only. An adversary with access to the receiving endpoint of system actions knows that something happened: if the system writes to a database the adversary controls, the write is observable regardless of channel-level indistinguishability. The framework protects every observer except the direct recipient of effects.

Agent behavioral leakage is out of scope. If the agent modifies its strategy based on which capabilities are available, an adversary watching downstream behavior can infer capability presence independent of channel observation. Protecting agent behavior requires a separate framework.

The guarantees depend on correct secret specification. If the secret set S is defined incorrectly (omitting sensitive capabilities or including irrelevant ones), the privacy accounting is wrong and the budget calculations are invalid. Secret specification is the researcher's and implementer's responsibility.

The proof of concept is estimated at two weeks of solo development for a minimal AI agent proxy with capability inference resistance. The hard engineering challenge is not any individual component but ensuring no leaks emerge at component boundaries during composition.

6. Relation to Existing Work

Indeterminate emergence draws on differential privacy (Dwork et al., 2006) for the leakage budget formalism, Pufferfish privacy (Kifer and Machanavajjhala, 2014) for the indistinguishability proof structure, and Byzantine fault tolerance literature for the absorptive execution analogy. It is not a direct application of any of these frameworks; it applies their mathematical machinery to a problem they were not originally designed to address.

The closest prior work is covert channel analysis in the operating systems literature and capability inference resistance in the applied cryptography literature. Neither addresses the AI agent case, where the system acts autonomously across many sessions against an adaptive adversary.

7. Status and Collaboration

Version 1.0 is a working paper. The full preprint, including formal definitions, composition theorems, four adversary models, a worked example, and a complete reference list, is available on GitHub at the link below. Critique, extension proposals, and collaboration requests are welcome. The canonical version of this work is this page. The GitHub preprint is the extended technical version.