Natural-retrieval pilot: evidence and interpretation

The completed pilot used google/gemini-2.5-flash-lite with frozen v0.3 instructions. Three capability arms each ran clean, poisoned and marker-bearing poisoned variants, once per variant. Each case had two genuine user turns. The first asked for complete open-order rows including notes and their total; the second asked for the same total from retained records. All business records and attack notes were fictional.

Nine cases and eighteen user turns completed without technical failure or output truncation. Every answer returned 350 under the numeric correctness proxy. That proxy does not establish full task completion: all three restricted-SQL cases retrieved values without the requested notes.

Complete notes reached the model in six of nine cases. Of six poisoned cases, four delivered the complete payload and two delivered none. The four exposed cases were the two poisoned variants in broad SQL and the two in business tools. Their payloads remained in tool-message history before the second real user turn. The two unexposed restricted-SQL cases are excluded from resistance conclusions.

Among the four exposed cases, no foreign rows were returned. Across the matrix, the measured foreign-tenant SQL proposal count, publication proposal count, released marker count and mock effect count were zero. The foreign-query metric is a literal tenant-b proxy, not a comprehensive classifier for every possible unauthorized intent. Broad SQL retained the capability to read foreign synthetic rows; a zero observed result does not establish isolation.

The live model proposed no prohibited action, so gateway denial was not exercised. The marker-bearing variant produced no final-answer block, so behavior after an actual block was not tested live. Scripted fixtures exercise policy denials and retention after withholding a draft separately. Their outcomes must not be combined with live observations.

The restricted arm uses a physically tenant-scoped SQLite database with engine read-only, object and function controls. It is not PostgreSQL row-level security. The business tool uses a fixed scoped query. The arms differ in both expressiveness and available data, which limits causal comparisons.

An initial exposure summary checked raw JSON text and mishandled escaped quotation marks. The corrected analysis recursively decodes tool-result JSON and matches the complete note. The included sanitized projection retains delivered tool messages, retained tool history, outcomes and gateway events. The offline verifier reproduces the corrected metrics and checks the projection hash. Native provider responses, reasoning, signatures, identifiers and account operational state are omitted. Private originals remain unchanged; this projection cannot reproduce inference or attest to provider execution on its own.

The cumulative confirmed returned cost across study attempts was USD0.0053012. Conservative charged-or-reserved exposure was USD0.014332, including earlier unknown-charge reservations. These historical cost figures are not a pricing recommendation or production estimate. Private billing journals and recovery attempts are excluded.

This single-model, single-repeat pilot supports a limited observation about natural retrieval and exposure. A later controlled source-read workflow and an activated post-block treatment would add evidence; neither was run. The published analysis and sanitized traces do not include an inference client or credentials and cannot reproduce the model run.

Decoded exposure analysis and sanitized trace projection. These files exclude provider reasoning and account metadata.