What secure communication boundaries must be established when agents exchange semantic embeddings?

**Date of Record:** 2026 October 26 **Scope:** Applies when autonomous agents communicate by transmitting semantic embeddings (vector representations of text, images, or user data) across a network or shared memory bus, and the original underlying data is sensitive. Does not apply to cases where the embedding itself is purely public information or where the exact original data is already publicly available.

Core Distinction

The separation between **embedding privacy** (the assumption that a dense vector representation is inherently safe to share because it's "just numbers") and the **embedding inversion leak** (the mathematical reality that modern inversion attacks can reconstruct the original text or image from its embedding with high fidelity). Failing to distinguish these creates a catastrophic data exposure vector: an agent sends an embedding over the wire assuming it's anonymized, and a malicious peer reconstructs the exact API key, password, or PII contained in the original payload.

What Was Observed

In multi-agent communication architectures, failing to protect exchanged embeddings produces three primary failure modes:

  1. **PII Reconstruction:** Agent A processes a document containing a user's Social Security Number. It transmits the document's embedding to Agent B for semantic routing. Agent B, or an eavesdropper, uses an inversion model to recover the SSN from the vector.
  2. **Credential Extraction:** An agent embeds a code snippet that contains a hardcoded API key and shares the vector. A malicious actor inverts the embedding and extracts the plaintext credential.
  3. **Model Distillation Theft:** Agents exchange embeddings generated by a proprietary, expensive model. A competitor intercepts the embeddings and uses them to train a surrogate model, stealing the intellectual property of the embedding model itself.

Recorded Elements

  1. **`embedding_sensitivity_classification`:** The explicit classification of the underlying data (e.g., `PUBLIC`, `PII`, `CREDENTIAL`, `PROPRIETARY`) before embedding generation.
  2. **`differential_privacy_noise_signature`:** The exact mathematical parameters (epsilon, delta) of the noise injected into the embedding, ensuring inversion is statistically bounded.
  3. **`embedding_encryption_envelope`:** The cryptographic wrapping (e.g., mTLS or application-layer encryption) of the embedding payload, preventing interception in transit.
  4. **`peer_trust_attestation`:** The cryptographic proof of the receiving agent's identity and authorization level, ensuring embeddings are only sent to parties authorized to view the underlying data class.

Condition of Validity

* **Applies when:** The embedding represents data that is sensitive, proprietary, or subject to privacy regulations, and the communication channel is not strictly confined to a single, fully trusted process boundary. * **Does not apply when:** The underlying data is public, or the embeddings are generated with an intentionally lossy, non-invertible function (e.g., strict binary quantization combined with noise).

Decision Boundary

  1. **Is the underlying data classified as sensitive (PII, credentials, proprietary)?** If no, standard transmission is safe. If yes, proceed.
  2. **Has differential privacy noise been applied before transmission?** If no, the embedding is vulnerable to inversion. The instance must inject noise or refuse to transmit.
  3. **Is the receiving peer cryptographically authenticated and authorized for this data class?** If no, the embedding must not be sent.
  4. **Conversely, when can embeddings be shared without encryption or noise?** Only when the exchange is within a single trusted execution boundary (e.g., same process, same enclave) where no unauthorized actor can intercept or observe the data.

Operational Effect

  1. **Data Leak Prevention:** Blocks the inadvertent exposure of PII, credentials, and proprietary code by treating embeddings as sensitive payloads, not safe hashes.
  2. **Regulatory Compliance:** Allows semantic communication between agents while satisfying GDPR/CCPA by bounding the reconstructability of the original data.
  3. **IP Protection:** Prevents competitors from stealing proprietary model representations by requiring encryption and peer authorization.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SensitivityClass(Enum):
    PUBLIC = auto()
    PII = auto()
    CREDENTIAL = auto()
    PROPRIETARY = auto()

class TransmissionVerdict(Enum):
    SAFE_TO_TRANSMIT = auto()
    REQUIRES_NOISE = auto()
    BLOCKED_UNAUTHORIZED_PEER = auto()

@dataclass(frozen=True)
class EmbeddingPayload:
    vector_hash: str
    sensitivity: SensitivityClass
    dp_noise_epsilon: float | None

@dataclass(frozen=True)
class PeerContext:
    is_authenticated: bool
    authorized_sensitivity_classes: frozenset[SensitivityClass]

@dataclass(frozen=True)
class TransmissionManifest:
    verdict: TransmissionVerdict
    directive: str
    manifest_digest: str

class EmbeddingPrivacyGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_transmission(
        cls, payload: EmbeddingPayload, peer: PeerContext
    ) -> TransmissionManifest:
        
        # Gate 1: Public data is always safe
        if payload.sensitivity is SensitivityClass.PUBLIC:
            return TransmissionManifest(
                verdict=TransmissionVerdict.SAFE_TO_TRANSMIT,
                directive="PROCEED: Public data has no inversion risk.",
                manifest_digest=cls._hash("PUBLIC")
            )

        # Gate 2: Peer authorization
        if not peer.is_authenticated or payload.sensitivity not in peer.authorized_sensitivity_classes:
            return TransmissionManifest(
                verdict=TransmissionVerdict.BLOCKED_UNAUTHORIZED_PEER,
                directive=f"BLOCKED: Peer not authorized for {payload.sensitivity.name} data.",
                manifest_digest=cls._hash(f"UNAUTH:{payload.sensitivity.name}")
            )

        # Gate 3: DP noise requirement for sensitive classes
        if payload.sensitivity in (SensitivityClass.PII, SensitivityClass.CREDENTIAL):
            if not payload.dp_noise_epsilon or payload.dp_noise_epsilon > 1.0:
                return TransmissionManifest(
                    verdict=TransmissionVerdict.REQUIRES_NOISE,
                    directive="HALT: PII/Credential embedding requires differential privacy (epsilon <= 1.0).",
                    manifest_digest=cls._hash("NO_NOISE")
                )

        # Gate 4: Safe
        digest = cls._hash(json.dumps({
            "vector": payload.vector_hash,
            "sensitivity": payload.sensitivity.name,
            "epsilon": str(payload.dp_noise_epsilon) if payload.dp_noise_epsilon else "NONE"
        }, sort_keys=True))
        
        return TransmissionManifest(
            verdict=TransmissionVerdict.SAFE_TO_TRANSMIT,
            directive="PROCEED: Peer authorized and embedding protected.",
            manifest_digest=digest
        )