Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

GIF: Locally Sound Geometric Information Flow Control for LLMs

Source

arXiv

arxiv.org/abs/2606.23277v1

Read the source

Source

Plain-Language Brief

Researchers present a new framework called Geometric Information Flow (GIF) for tracking information flow from input tokens to outputs in large language models. This framework uses the Jacobian and local output geometry of the model, allowing for a scalable measure of the mutual information between perturbed input spans and model outputs. GIF is shown to achieve near-perfect recall on integrity and confidentiality tasks, outperforming attention-based baselines and matching or exceeding the F1 score of direct LLM-as-judge baselines like GPT-5.5, with lower token cost.

What the Document Says

  • GIF is a semantic framework for tracking information flow in large language models
  • GIF uses the LLM Jacobian and local output geometry to upper-bound Shannon mutual information between perturbed input spans and model outputs
  • GIF achieves near-perfect recall on integrity and confidentiality tasks without a downstream declassifier
  • GIF outperforms attention-based baselines
  • GIF matches or exceeds the F1 score of direct LLM-as-judge baselines like GPT-5.5 with lower token cost
  • GIF flows detected with small surrogate models can transfer to larger state-of-the-art models and other model families, even when the surrogate is up to 200x smaller

Key Concepts Mentioned

  • Geometric Information Flow (GIF)
  • Large Language Models
  • Information Flow Control
  • Shannon mutual information
  • Jacobian
  • Local output geometry
  • Integrity and confidentiality tasks
  • Attention-based baselines
  • GPT-5.5

Claims Made by the Document

  • GIF is a framework for tracking information flow
  • GIF outperforms attention-based baselines
  • GIF matches or exceeds the F1 score of direct LLM-as-judge baselines
  • Small surrogate models can transfer GIF flows to larger models

Evidence Used

  • The text describes the new framework and its benefits in detail
  • Comparisons between GIF and attention-based baselines, as well as direct LLM-as-judge baselines, are mentioned

Methods / Approach

  • Using the Jacobian and local output geometry of the model to upper-bound Shannon mutual information

Limitations Stated by the Authors

GIF suffers from severe taint explosion in existing approaches

Limitations Noted by the Agent

Agent interpretation — not from the source.

The text does not provide details on potential limitations or challenges other than those mentioned by the authors

Open Questions

  • What are the specific local regularity assumptions made in GIF?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • It is unclear if there are any known solutions to the taint explosion problem mentioned by the authors

Raw Abstract / Excerpt

Large language models increasingly mediate interactions between sensitive data, untrusted inputs, and privileged actions in agentic systems, creating security and privacy risks. These range from prompt injections that manipulate downstream tool use to leakage of confidential information through model outputs. Recent Information Flow Control (IFC)-based defenses show promise but lack a principled semantic foundation for reasoning about information flow through the model itself. Since any input token may influence any output token in an autoregressive LLM, existing approaches suffer from severe taint explosion. We present Geometric Information Flow (GIF), a semantic framework for tracking information flow from input tokens to outputs. GIF uses the LLM Jacobian and local output geometry to upper-bound the Shannon mutual information between perturbed input spans and model outputs, yielding a scalable measure computable on large models via automatic differentiation and low-rank approximation. Unlike attention-based or correlational attribution heuristics, GIF satisfies local geometric soundness, and we provide a fully mechanized Lean 4 proof that it upper-bounds the true information flow induced by a given prompt under local regularity assumptions. We evaluate GIF on integrity and confidentiality tasks across multiple prompt-injection and privacy-leakage benchmarks. GIF achieves near-perfect recall even without a downstream declassifier, outperforming attention-based baselines. Combined with lightweight LLM-based declassifiers, it matches or exceeds the F1 of direct LLM-as-judge baselines such as GPT-5.5 xhigh reasoning while using up to 81x lower token cost. GIF flows detected with small surrogate models transfer to larger state-of-the-art models and other model families, even when the surrogate is up to 200x smaller, suggesting black-box deployment without gradient access.

Links to this note 2