What an agent learns from a refusal over stdio: body versus timing
The refusal text carried 0.000 bits about the reason on all 7 tools, but the largest per-cell timing estimate (0.395 to 0.637 bits) exceeded the permutation null (0.214 to 0.281) in 3 of 3 runs, refuting the timing prediction.
Mixed resultWhere does it stop?Working note
- Designed for
- Built to test how much an agent can recover about the reason for a guard refusal from the refusal's text and timing, compared with the operator's channel.
What was tested
A quantitative information-flow instrument ran 57 recipes on 7 tools of the guard’s binary, 3 runs, one client over stdio. It measured the bits about the refusal reason in the agent-visible body, the response timing and the operator’s channel, against a permutation null, with the parent build as a liveness arm. Predictions were written first.
What we observed
The refusal body carried 0.000 bits on all 7 tools, where the parent build had returned 16 distinguishable bodies. The operator channel carried up to 3.000 bits, as designed. Timing was not silent: the largest per-cell estimates were 0.637, 0.459 and 0.395 bits against null 99th percentiles of 0.281, 0.220 and 0.214, so the prediction of no timing contribution failed in 3 of 3 runs.
What this means for Heimdall
This asks what a refusal discloses to the agent. The uniform text did its job: the body carried nothing about the reason, while the operator’s channel did. Timing still carried some, so uniform text alone does not close the side channel.
Limits
One stdio stand and machine; upward finite-sample bias; a build older than today’s code; network transports unmeasured; whether a known redactor bypass was closed is not stated.
What remains open
Rebuild both binaries here and rerun on today’s proxy and gateway.