Block Means Yes: Extracting Protected Agent Data Through a Guard’s Own Refusal Signal

Abstract

Agent systems increasingly place a response-level guard in front of a model that can see secrets in its prompt, tools, or retrieved documents, assuming that if the guard blocks the leaking response, the secret is safe. It is not. A correctly-functioning guard that never sees the secret in its own policy still leaks it through the *pattern* of its BLOCK/ALLOW decisions: each decision is one bit of an attacker-chosen predicate about the value — structurally a padding oracle whose novel target is the refusal signal.