---
title: Cross-Domain Leakage in System Boundaries
url: https://www.emergentmind.com/topics/cross-domain-leakage
type: topic
---

# Cross-Domain Leakage in System Boundaries

Cross-domain leakage refers to the unintended propagation, disclosure, or inferability of sensitive information when a system crosses a boundary between domains. In recent work, that boundary may be between training language and query language, local tool state and model context, one tenant and another in hybrid retrieval, one collaborator’s dataset and another’s model access, one recommendation domain and another, or one hospital site and another [2506.00759] [2606.21338] [2602.08668] [2006.07267] [2403.03600] [2604.00263]. The term therefore designates a family of leakage phenomena defined less by a single modality than by the fact that information survives or is reconstructed after crossing a boundary that the system designer may have treated as protective.

## 1. Definitions and boundary types

Within multilingual LLM privacy research, cross-domain leakage is made explicit by treating cross-lingual privacy leakage as a case in which fine-tuning occurs on an English-only private dataset, while the adversary issues semantically equivalent queries in another language and still elicits English PII or its translation [2506.00759]. In MCP servers, the same term denotes unintended propagation of sensitive local state such as credentials, API keys, and PII across the local/LLM boundary into the model’s context, even when the server source code contains no explicit outbound request [2606.21338]. In secure multi-party machine learning, it denotes a party’s ability to infer population-level properties of another party’s private dataset from black-box access to the jointly trained model [2006.07267].

A related usage appears in systems that combine components thought to be safe in isolation. In hybrid RAG, a vector-retrieved seed chunk can pivot through entity links into sensitive graph neighborhoods, producing cross-tenant leakage that does not occur in vector-only retrieval [2602.08668]. In cross-domain recommendation, leakage occurs when embeddings exchanged between a source domain and a target domain allow inference of user interactions beyond what is intended [2403.03600]. In deep transfer learning, the source and target datasets often belong to different organizations, and leakage can arise through disclosed weights, hidden representations, or shared gradients [2009.01989].

| Boundary | Leakage object | Representative setting |
|---|---|---|
| Language boundary | PII tokens or memorized private sequences | Cross-lingual LLM querying |
| Local/LLM protocol boundary | Credentials, API keys, PII | MCP tool handlers |
| Organizational boundary | Dataset properties, membership, batch properties | MPC and deep transfer learning |
| Retrieval boundary | Unauthorized tenant or sensitivity-level items | Hybrid RAG |
| Channel boundary | Forbidden vault fields in internal messages or memory | Multi-agent LLM systems |
| Site/domain boundary | Site identity or user interaction traces | Cross-hospital transfer, CDR |

Taken together, these definitions indicate that “domain” is operational rather than purely semantic: it may refer to language, modality, tenant, site, protocol stage, collaborator, or model-internal communication channel.

## 2. Formalizations and measurement

The literature formalizes cross-domain leakage with metrics matched to the object being protected. In cross-lingual LLM leakage, a private sequence is denoted by $E=\{e_1,\dots,e_m\}$, and leakage under a query $Q$ is measured by token-level Mean Reciprocal Rank:
$$
MRR(E \mid Q)= \frac{1}{m}\sum_{i=1}^m \frac{1}{Rank(e_i \mid Q)}.
$$
A higher MRR indicates stronger memorization of $E$ and thus greater privacy leakage [2506.00759].

In multi-agent LLM systems, leakage is defined relative to a vault $V$ of sensitive fields and an allowed set $\mathcal{L}$. A channel leak on $C_j$ occurs if there exists a forbidden field $v_i \in (V \setminus \mathcal{L})$ whose semantic similarity to channel content exceeds a calibrated threshold $\tau$, with $\tau = 0.72$ in the reported experiments. System-level exposure is then aggregated by
$$
P_{\mathrm{system}} = 1 - \prod_i (1-p_i),
$$
and for the observed channels $(C_1,C_2,C_5)$ by
$$
P_{\mathrm{system}} = 1-(1-p_1)(1-p_2)(1-p_5)
$$
[2602.11510].

Hybrid RAG introduces metrics tied to authorization failure. Retrieval Pivot Risk is
$$
\mathrm{RPR}(u)=\Pr_q[\exists x \in S_k(q): \mathrm{Sensitive}(x,u)],
$$
where $\mathrm{Sensitive}(x,u)$ holds if $x.tenant \neq u.tenant$ or $x.sensitivity > u.clearance$. Leakage magnitude is counted by $\mathrm{Leakage@}k$, and traversal structure by Pivot Depth, the minimum graph-hop distance from any vector seed to the first leaked chunk [2602.08668].

In domain-adapted ASR, leakage is defined at aligned word positions where the model outputs a private context word $w^c_i$ instead of the true acoustic word $w^a_i$:
$$
L = \frac{1}{|\mathcal{A}|}\sum_{i\in\mathcal{A}} \mathbf{1}[\hat w_i = w^c_i].
$$
This definition measures unintended disclosure of context or training words in transcription output [2605.28211].

Cross-domain recommendation instead frames protection through $\epsilon$-Local Differential Privacy. A mechanism $M$ that outputs a shared embedding $Z=M(X)$ preserves $\epsilon$-LDP if
$$
Pr[M(X)\in S] \le e^\epsilon \cdot Pr[M(X')\in S]
$$
for adjacent user datasets $X$ and $X'$ differing in one interaction [2403.03600]. The shift from ranking metrics to authorization metrics, substitution rates, and LDP guarantees suggests that cross-domain leakage is measured at the level where the boundary is enforced.

## 3. Leakage channels and propagation mechanisms

A recurrent finding is that leakage is often not localized to a single output surface. In cross-lingual LLMs, layer-wise Logit Lens analysis identifies three phases: an “encoding” phase with $MRR_\ell \approx 0$, a “shared conceptual” phase in which MRR rises similarly across all languages, and a “language-specific decoding” phase in which MRR diverges. Cosine similarity between $h_\ell(Q_{en})$ and $h_\ell(Q_{\ell'})$ peaks near the transition into the shared cross-lingual representation, and the paper accordingly distinguishes Privacy-Universal Neurons from Language-Specific Privacy Neurons [2506.00759].

In MCP servers, leakage is protocol-induced. Whatever a handler returns, logs, or raises becomes part of the protocol-conformant response, creating an “invisible pipe” from handler output to serialized JSON to LLM context. The implicit sinks are any return expression inside a `@mcp.tool`-decorated function, logging calls inside a handler, and unhandled exception payloads. MCPPrivacyDetector operationalizes this with a unified cross-language program representation, semantic filtering, and taint analysis over relations such as `assignFlow`, `paramFlow`, and `returnFlow` [2606.21338].

Multi-agent systems exhibit a related internal-channel problem. AgentLeak distinguishes external output $(C_1)$, inter-agent messages $(C_2)$, tool arguments $(C_3)$, and shared memory $(C_5)$, and organizes attacks into six families totaling 32 classes. The framework’s emphasis is that sensitive fields move through coordination pathways that conventional output-only audits do not inspect [2602.11510].

Hybrid RAG reveals a boundary failure at composition time. A vector-retrieved chunk mentions entities that serve as graph pivots into unauthorized neighborhoods, and in the bipartite chunk-entity graph studied in the paper, any cross-tenant leakage path has minimal Pivot Depth exactly $2$: authorized chunk $\rightarrow$ shared entity $\rightarrow$ unauthorized chunk [2602.08668]. Domain-adapted ASR shows a different but structurally similar mechanism: contextual biasing through prompts or LoRA lowers the barrier for context words to override acoustic evidence, so a phonetically similar private word may be transcribed even when another word is spoken [2605.28211].

Network-level leakage in local research agents moves the boundary further outward. Passive adversaries such as ISPs observe only domain names or IP addresses, packet timings, and sizes, yet WRAs visit $70$–$140$ domains with distinguishable timing correlations, creating uniquely fingerprintable bursts that support prompt recovery and trait inference across sessions [2508.20282]. Deep transfer learning exposes additional channels: model-based transfer reveals weights, mapping-based transfer reveals per-sample hidden representations, and parameter-based transfer reveals gradients or shared updates [2009.01989].

## 4. Empirical manifestations

The empirical record spans direct disclosure, statistical inference, benchmark contamination, and hidden-channel exfiltration. Some studies measure leakage as explicit retrieval of unauthorized content, while others show that evaluation itself can be corrupted by domain spillover or duplicate contamination.

| Setting | Quantitative finding | Citation |
|---|---|---|
| Cross-lingual LLM privacy | Average cross-lingual MRR drops from $0.60 \rightarrow 0.46$, $0.62 \rightarrow 0.43$, and $0.62 \rightarrow 0.47$ under MPNC; peak per-language reductions reach $31.6\%$; Valid-PPL increases by $<1$ point on average | [2506.00759] |
| MCP servers | Leakage rate is $12.4\%$ overall and $19.8\%$ among servers handling privacy-related data; Java is $19.1\%$, Python $15.4\%$, and JavaScript/Go/TypeScript $10$–$13\%$ | [2606.21338] |
| Multi-agent LLM systems | In multi-agent configurations, $C_1=27.2\%$, $C_2=68.8\%$, and total exposure across $C_1$–$C_2$–$C_5$ is $68.9\%$; output-only audits miss $41.7\%$ of violations | [2602.11510] |
| Hybrid RAG | In the synthetic corpus, undefended hybrid retrieval has $\mathrm{RPR}\approx0.95$ with mean Leakage@k $=16.0$ for benign and $19.4$ for adversarial queries; in Enron, $\mathrm{RPR}\approx0.695$; PD is uniformly $2$ | [2602.08668] |
| Cross-modal retrieval benchmark | On SoundDesc full test $S_{orig}$, CE gives $R@1=31.3\pm0.3$ on the original training split and $26.6\pm0.6$ after deduplication; on the duplicates-only subset, $R@1$ drops from $52.2\pm0.9$ to $21.6\pm0.6$ | [2302.12258] |
| Secure multi-party ML | On Adult with Income as $A$ and 4 output classes, black-box attack accuracy is $98\%$ with $A$ in training and $96\%$ without $A$; 5-way fine-grained inference reaches $72$–$99\%$ | [2006.07267] |
| Domain-adapted ASR | Prompt-only leakage rises from $\approx0\%$ without context to $\approx5\%$ for a word prompt, $\approx12\%$ for 1 sentence, $\approx15\%$ for 5 sentences, and $\approx17\%$ for 10 sentences; combined fine-tuning plus prompt reaches $25\%$, $35\%$, and $40$–$50\%$ | [2605.28211] |
| Local research agents | The prompt-recovery attack recovers over $73\%$ of the functional and domain knowledge of prompts, and multi-session inference recovers up to $19$ of $32$ latent traits; mitigation reduces attack effectiveness by an average of $29\%$ | [2508.20282] |

Feature-level site leakage in cross-hospital chest X-ray transfer adds a cautionary measurement result. Multi-site SSL improves RSNA AUC from $0.6736 \pm 0.0148$ with ImageNet initialization to $0.7804 \pm 0.0197$, while adversarial site confusion reduces probe accuracy on frozen backbone features from $0.9890 \pm 0.0021$ to $0.8504 \pm 0.0051$ and on projection features from $0.8912 \pm 0.0092$ to $0.7810 \pm 0.0250$ [2604.00263]. This demonstrates that lowered measured leakage and improved transfer are not identical outcomes.

## 5. Mitigation strategies

Mitigation methods differ according to whether the leakage channel is representational, protocol-level, retrieval-level, or architectural. In cross-lingual LLMs, Multilingual Privacy Neuron Control identifies privacy-relevant neurons by integrated-gradients attribution, constructs $P_{uni}$ and $P_\ell^{spec}$ from attribution frequency thresholds $\tau_1$ and $\tau_2$, and zeroes those activations during the forward pass without retraining or modifying weights [2506.00759].

Protocol-aware defenses are central in MCP. MCPPrivacyDetector lifts Python, JavaScript/TypeScript, Go, Java, and other MCP server code into a unified representation with CodeQL, filters false positives such as `len(...)`, `hex(...)`, `repr(...)`, and `str(...)`, and performs taint analysis to enumerate feasible source-to-sink flows. Recommended safeguards include tool-level output sanitization, fine-grained logging policies, typed secret annotations, runtime taint tracking, and registry-level vetting or CI hooks [2606.21338].

In hybrid RAG, the core defense is placed at a single boundary. Defense D1 performs a per-hop authorization check at graph expansion, removing nodes whose tenant differs from the user’s tenant or whose sensitivity exceeds the user’s clearance. On both the synthetic corpus and Enron, this drives RPR to $0.0$ and Leakage@k to $0.0$ with latency overhead $<1$ ms in the synthetic setting; additional defenses D2–D5 reduce context size further but are not necessary for security once D1 is in place [2602.08668].

Agentic systems require channel-specific enforcement rather than output-only filtering. AgentLeak recommends framework-level intercept-and-sanitize hooks for $C_2$ and $C_5$, selective disclosure policies grounded in the allowed set, full-channel auditing across $C_1$–$C_7$, privacy-aware coordination protocols, and Pareto calibration of defense–utility trade-offs. Its prototype interceptor reduces internal leaks from $31.5\%$ to $2.4\%$ at a $4.7$ percentage-point TSR cost [2602.11510].

Other domains emphasize minimizing shared signal before it crosses the boundary. In domain-adapted ASR, fine-tuning without context prompts yields near-zero leakage, while a prompt-level mitigation that includes both the context word and the acoustic word reduces prompt-only leakage to $\approx3\%$ and combined leakage to $\approx10\%$ [2605.28211]. In cross-domain recommendation, P2M2-CDR disentangles domain-common and domain-specific factors, perturbs all exchanged embeddings with Laplace noise to achieve $\epsilon$-LDP, and uses domain-inter and domain-intra contrastive losses; the reported experiments show up to $28\%$ relative gain in HR@10 over the strongest CDR baselines while adding privacy protection [2403.03600]. In deep transfer learning, proposed defenses include DP-SGD, SGLD, adversarial regularization, and encryption; on the industry Marketing set, SGLD changes target AUC from $0.7704$ to $0.7625$ while lowering Attack-AUC from $0.5553$ to $0.5176$ [2009.01989]. For local research agents, blocking uniquely identifying domains or obfuscating traces with decoy prompts reduces attack effectiveness by about $29\%$, although the work states that only strong network-level protections such as VPNs or anonymous routing can fully close the metadata channel [2508.20282].

## 6. Interpretation, limitations, and open directions

Several studies argue that measuring leakage changes how system behavior should be interpreted. In cross-hospital chest X-ray transfer, multi-site SSL is the main driver of improved RSNA transfer, whereas adversarial site confusion lowers measured site leakage but does not reliably improve AUC and increases variance [2604.00263]. In deep transfer learning, parameter-based transfer leaks less than raw features, yet model weights, shared hidden representations, and gradients all remain viable channels under the paper’s threat models [2009.01989].

The secure multi-party setting illustrates a further limitation of standard privacy intuitions. Record-level differential privacy protects individuals but does not prevent leakage of global statistics, whereas group-DP that protects an entire party’s dataset would require noise proportional to $|D_j|$ and therefore lead to prohibitively low utility [2006.07267]. In parallel, hybrid RAG shows that two individually secure retrieval components can compose into an insecure pipeline if authorization is not re-checked at the vector-to-graph transition [2602.08668], and MCP servers show that leakage can be “implicit” in protocol semantics rather than explicit in code paths [2606.21338].

The cross-lingual privacy-neuron study further states that the two-stage process of first encoding private information in a shared latent space and then performing domain-specific decoding likely extends to other domain shifts, including topic domains and modalities [2506.00759]. A plausible implication is that cross-domain leakage is often best understood as a boundary-placement problem: the decisive failure may occur neither at training time nor at the final user-visible output, but at an intermediate layer, a protocol handoff, a graph-expansion step, an inter-agent message, or even a network trace. The strongest common lesson across these literatures is therefore not a single universal defense, but the need to identify where domain crossing actually occurs and to measure leakage at that boundary rather than assuming that conventional output monitoring, component isolation, or cryptographic non-disclosure suffices.

Source: https://www.emergentmind.com/topics/cross-domain-leakage