Context Isolation — References

The confinement problem is old and well described; what is new is only that the confined computation is a model call and the leak path is a cache or a summary.

The underlying problem

• A Note on the Confinement Problem (Butler W. Lampson, Communications of the ACM, 1973) — the original statement of preventing a program from leaking the data entrusted to it, including the enumeration of covert channels. The reason a leak analysis has to cover caches, timing, and derived artefacts rather than only the obvious data path.
• The Protection of Information in Computer Systems (Jerome H. Saltzer and Michael D. Schroeder, Proceedings of the IEEE, 1975) — complete mediation and least privilege; the argument that a boundary enforced at some access points is not a boundary.
• Goguen and Meseguer, 1982, on security policies and security models (IEEE Symposium on Security and Privacy) — noninterference, which gives a precise form to the property wanted here: one tenant's input must make no observable difference to another tenant's output. Cited by name.

Separation policy

• Bell and LaPadula, 1976, on a unified exposition of the secure computer system model (MITRE technical report) — the confidentiality lattice and the formal basis for the rule that information may not flow from a higher classification to a lower one. Cited by name; the report was issued in several revisions.

Why the sub-call boundary is also a safety control

• Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (Greshake et al., 2023), arXiv:2302.12173 — relevant here for its demonstration that the blast radius of adversarial text is determined by what else is reachable from the context it lands in.

No verified reference is recorded for cache-key isolation in model-serving paths, quarantined sub-call design, or leak testing with canary markers. The security models above describe the property; the mechanisms for obtaining it in this setting are engineering practice.