Beyond Distribution: Empirical Validation of Entity-Level Defense in Multi-Model AI Decision Protection

Overview Enterprise data loss prevention (DLP) systems protect sensitive data through entity redaction — replacing PII with tokens such as [REDACTED]. This study evaluates whether redaction-based approaches survive collaborative multi-model reconstruction attacks, a threat model relevant to agentic AI deployments where multiple frontier LLMs coordinate across distributed fragments. We introduce Semantic Surrogate, a Layer 3 (L3) defense that replaces real entities with plausible fiction before fragmentation, and validate it against 7 frontier models (GPT-4o, Claude Sonnet 4.5, Grok-3, Gemini 2.0 Flash, DeepSeek V3, DeepSeek R1, Zhipu GLM-4-Plus) from 6 providers across 50 queries, 3 runs with fixed random seed (seed=42). Cross-generator validation extends to 6 frontier models from 6 providers across 3 geographic regions (18,232 API calls). Key Findings (32 findings, 7 contributions) Redaction is anti-defense: naive redaction (B1) yields 35.3% ±3.1% pass — 39.4pp below the undefended baseline (McNemar χ² = 52.74, p < 10−6). [REDACTED] tokens leak entity position, count, and type, producing median 1.41× attack amplification with 38% of previously-safe queries flipped to breach. Defense gradient: B1 Redact (35.3%) < B2 Random (67.3%) < L2 Baseline (74.7%) < B3 Surrogate (93.3%). Only semantic plausibility — not entity removal alone — exceeds the undefended baseline. Distribution + Surrogate (L2+L3): 93.3% ±1.2% text-based D_A pass; entity-weighted D_A reaches 97.3% ±1.2% with entity string recovery dropping to 0.023 ±0.006. Standard deviation reduction from 8.1% to 1.2% demonstrates L3 stabilizes protection across runs. Informed attacker robustness (E6): under three progressive knowledge levels — awareness of surrogation (E6a), knowledge of the decoy entity pool (E6b), and full methodology knowledge (E6c) — protection degrades monotonically: 94.7% → 86.0% → 74.0% → 66.0% (Cochran-Armitage z = −6.73, p < 10−10). Even under full knowledge, the defense retains 66% protection — substantially above B1 (35.3%) and the only method retaining recoverable utility. Defense-utility feasibility: Semantic Surrogate achieves formally equivalent overall quality to redaction (5.4/10 vs. 5.4/10, TOST p = 0.0003, 90% CI [−0.40, +0.48] within ±1.0 equivalence margin) with significantly higher semantic preservation (SBERT 0.900 vs. 0.836, p < 0.001) and actionability (6.2 vs. 5.7, p = 0.047). B3 is the sole method satisfying both defense and utility constraints. Cross-generator signal-type boundary (E8-Combined, new in v3.1): validation across 6 frontier models from 6 providers (18,232 API calls) reveals a binary signal-type partition — entity and numeric signals reach 0% extraction under layered defense (MVQD+TRT), while categorical signals persist at 28–84% regardless of configuration. The categorical ceiling is architectural, not model-specific. A TRT amplification effect (+33pp numeric extraction when entity anchors are removed) demonstrates defense layers interact causally, not additively. Business need alignment: under enterprise deployment assumptions, categorical signals that persist (industry, deal type, key risk) are already disclosed through standard business relationships. The defense boundary aligns with the operational confidentiality boundary: what needs protecting is fully protected; what persists was never operationally secret. Version History Version Date Changes v3.1.0 2026-03-06 Major addition. Added E8-Combined cross-generator validation (Section 4.10): 6 generators from 6 providers across 3 geographic regions, 18,232 API calls, 4 defense conditions. New signal-type defense boundary (Table 14) with per-signal decomposition. TRT amplification effect (Finding 30). Business need alignment analysis (Finding 31). Per-signal evaluation standard (Finding 32). Updated attacker model set to current frontier (Claude Sonnet 4.5, Grok-3, Gemini 2.0 Flash, DeepSeek R1, Zhipu GLM-4-Plus). Updated concurrent work coverage including MCP-ITP, Silent Egress, topology-dependent memory leakage, RL-based prompt injection. 32 findings (up from 26), 7 contributions (up from 6), ~45 references (up from ~30). 49 pages. v3.0.3 2026-03-01 Major revision. Added E6 informed attacker experiment (Section 4.9); statistical reporting and multiple comparisons disclosure (Section 3.4.1); Kerckhoffs Dimension discussion (Section 5.7); convergence with legal alignment frameworks (Section 5.4); per-vertical E6 tables (Appendix B.3–B.4); Vendor Configuration Disclosure appendix. 26 findings (up from 21), ~30 references (up from ~19). Removed "affirmative defense" language. v2.7 2026-02-23 FLEET benchmark results; TOST equivalence testing; 21 findings across 5 contributions. Reproducibility All experiments use fixed random seed (seed=42), 3-run protocol with majority-vote query-level outcomes. The 5-vertical, 50-query benchmark spans Healthcare, Finance, Legal, Insurance, and Government domains. E8-Combined cross-generator validation uses 6 frontier models from 6 providers (DeepSeek V3, GPT-4o, Grok-3, Gemini 2.0 Flash, Claude Haiku, Mistral Large) with 4 defense conditions across 4 PE M&A profiles (10 trials × 10 rounds per condition per generator). Statistical tests include McNemar’s exact test, Cochran-Armitage trend test, TOST equivalence, Clopper-Pearson confidence intervals, and Wilcoxon signed-rank tests. Confirmatory, exploratory, and descriptive findings are explicitly classified per Section 3.4.1. Series Context Eighth paper in the OIA Lab series. Second empirical paper; extends the Distribution Hypothesis (Chang, 2026a), which established that controlled fragment allocation — not fragmentation alone — determines AI decision protection (81.3% ±3.1%). The present work adds entity-level defense (L3), informed-attacker evaluation (E6), cross-generator validation (E8-Combined), and signal-type defense boundary analysis to the empirical program. Series: OIA Lab — AI Decision Settlement Research | Paper ID: P8 v3.1 | ORCID: 0009-0006-2124-564X Corresponding author: Y.C. Chang, OIA Lab (yc@oia-lab.com). This work involves pending U.S. provisional patent applications by the author; see Appendix D for disclosure.