Excess Information Flow: Insights & Applications

• Excess information flow is the phenomenon where information transfer exceeds defined bounds, affecting security, machine learning, and thermodynamic systems.
• Advanced methodologies, including generalized Jensen–Shannon divergence and timing-channel controls, quantify and limit such excess leakage.
• Practical applications span from enhancing distributed system security to refining autonomous system models while ensuring adherence to policy constraints.

Searching arXiv for relevant papers on excess information flow and adjacent formulations. “Excess information flow” is a multi-context technical term for information transfer that exceeds an intended bound, violates an admissible policy, or is misattributed by an inappropriate measure. In quantitative information flow it denotes leakage estimates that are implausible because they exceed the information content of the secret input or cannot be mapped to an attacker’s exhaustive search effort (Hussein, 2012). In timing-channel control it is the unintended leakage of sensitive information beyond the channels and rates that a system’s security policy intends to expose (Ford, 2012). In machine learning it is unauthorized influence of training data from domains a user is not permitted to access on inference outputs (Tiwari et al., 2023). In distributed security it is any flow that violates the relevant allowed flow policy of the computation domains at which the flow is enabled or originates (Matos et al., 2019). In information thermodynamics, by contrast, “excess information flow” is a formal component of information flow associated with conservative, nonstationary dynamics, distinguished from housekeeping flow (Maekawa et al., 26 Sep 2025).

1. Conceptual scope and recurring criteria

The term is used in several distinct literatures, but the recurring criterion is that “excess” is defined relative to a constraint that should not be exceeded. Depending on the setting, that constraint may be the size of a secret, a per-user timing-leak rate, a domain-based access policy, a localization requirement for causal attribution, or a thermodynamic decomposition into transient and steady components.

Domain	Meaning of excess information flow	Reference
QIF	Leakage estimate exceeds secret-size bounds or search interpretation	(Hussein, 2012)
Timing IFC	Leakage beyond intended channels and rates	(Ford, 2012)
ML IFC	Influence from disallowed training domains	(Tiwari et al., 2023)
Distributed IFC	Flow violating relevant allowed flow policy	(Matos et al., 2019)
Information thermodynamics	Conservative, nonstationary component of information flow	(Maekawa et al., 26 Sep 2025)

A second recurring criterion is operational interpretability. Several of the cited works reject measures that are unbounded, asymmetric in problematic ways, or unable to distinguish ignorance, conflict, or polyadic dependence. This appears in the critique of Bayesian KL-based QIF (Hussein, 2012), in the critique of transfer entropy and causation entropy as measures of information flow (James et al., 2015), and in empirical arguments that some monitored flow classes create label creep and runtime cost without corresponding security benefit (Staicu et al., 2019).

2. Quantitative information flow and bounded leakage

In quantitative information flow, excess information flow is leakage reporting that is larger than the secret itself or that cannot be consistently related to brute-force effort. The Dempster–Shafer generalization of QIF was proposed precisely to eliminate such pathologies (Hussein, 2012). The critique targets an earlier Bayesian method that modeled attacker beliefs as probability distributions and used Kullback–Leibler divergence to quantify belief updates. The identified weaknesses are finite-additivity forcing beliefs onto singleton sets, inability to represent ignorance or contradiction, inability to handle more than one secret input, asymmetry of KL divergence, undefined behavior when $p_2(x)=0$ and $p_1(x)>0$, and the absence of an upper bound.

The Dempster–Shafer formulation replaces precise probabilities with mass functions on a frame of discernment $\Theta$: $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$ Belief and plausibility are defined by

$$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$

This permits masses on singleton and nonsingleton sets, thereby representing nonspecificity and conflict in attacker beliefs.

The generalized framework defines prior and posterior attacker beliefs as mass functions $m_{\text{pre}}$ and $m_{\text{post}}$ over the secret frame $W_h$, combined and updated by Dempster’s rule and conditioning. It then introduces a generalized Jensen–Shannon divergence

$$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$

where $GS$ is a generalized Shannon quantity derived from aggregate uncertainty and generalized Hartley nonspecificity. The information-flow measure is

$p_1(x)>0$0

with $p_1(x)>0$1 the point mass on the actual high state.

The key theorem is the bound

$p_1(x)>0$2

This bound is the central anti-excess property: leakage can never exceed the entropy of the secret input (Hussein, 2012). The same framework supports multiple secrets by defining joint frames such as

$p_1(x)>0$3

The operational interpretation is explicit. If a secret has $p_1(x)>0$4 bits and the measured informing flow is $p_1(x)>0$5 bits, the residual uncertainty is $p_1(x)>0$6 bits, the exhaustive search space is $p_1(x)>0$7, and the reduction factor is $p_1(x)>0$8 (Hussein, 2012). In the password-checker example with $p_1(x)>0$9, so $\Theta$0 bits, reported flows include $\Theta$1, $\Theta$2, $\Theta$3, and $\Theta$4 bits; none exceeds the secret size.

3. Policy enforcement in systems and programming languages

In cloud systems, excess information flow is framed primarily as timing leakage. Timing Information Flow Control separates content information flow from timing information flow and attaches to each object a content label $\Theta$5 and a timing label $\Theta$6, with timing tags of the form $\Theta$7 where $\Theta$8 is a frequency bound in bits/sec (Ford, 2012). The basic non-declassifying send rule requires

$\Theta$9

and paced queues enforce

$$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$0

Deterministic execution prevents timing-to-content contamination, while pacers downgrade timing taint to a configured rate. The framework is explicitly designed to identify, aggregate, and bound excess timing flow without dismantling statistical multiplexing.

In distributed programming-language security, excess information flow is defined relative to local allowed policies rather than a single global lattice. The system distinguishes declared flow policies, introduced by constructs such as $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$1, from domain-specific allowed policies $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$2 (Matos et al., 2019). Two properties are central. Flow Policy Confinement requires that declarations do not exceed the allowed policy of the executing domain. Distributed Non-disclosure requires actual flows to align with the declared policy. Their combination yields Distributed Non-Interference: $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$3 Here excess flow has two forms: declared excess, where a program declares a policy more permissive than $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$4, and actual excess, where execution performs flows illegal with respect to the allowed policies of the domains where information originates.

In dynamic JavaScript monitoring, the term appears in a different but related sense. Excess information flow is the tendency of a monitor to track more flows than are necessary for the chosen policy, thereby inflating labels, reducing permissiveness, and increasing runtime cost without meaningful security benefit (Staicu et al., 2019). The formalization distinguishes explicit flows $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$5, observable implicit flows $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$6, and hidden implicit flows $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$7. The empirical conclusion is that implicit flows are expensive in terms of permissiveness, label creep, and runtime overhead; lightweight taint analysis is sufficient for most studied security problems, observable tracking is sometimes required for privacy-related code, and no evidence was found that tracking hidden implicit flows reveals otherwise missed security problems. In this setting, “excess” is not excessive leakage by the program, but excessive sensitivity by the monitor.

4. Machine learning and domain-conditioned non-interference

In machine learning, excess information flow refers to unauthorized influence of training data from security domains outside a user’s access policy on inference outputs (Tiwari et al., 2023). The formal objective is non-interference over domain partitions. If $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$8 is partitioned into security domains and $$m:2^{\Theta}\to[0,1], \qquad m(\emptyset)=0,\qquad \sum_{A\subseteq\Theta}m(A)=1.$$9 is a user policy, then $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$0 means that accessible domains agree. The non-interference condition is

$$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$1

A quantitative relaxation is also proposed: $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$2

The enforcement mechanism is a secure Mixture-of-Experts Transformer with one expert per domain, isolated per-domain parameters, and policy-aware gating. The paper’s main configuration uses adapters inserted before each MLP layer in GPT-2’s 12 Transformer blocks; the base model is frozen and trained only on public data, while adapters are trained per domain. At inference time, only experts in the accessible set are eligible for activation. The abstract forward form is

$$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$3

When the conditions on expert isolation, policy-masked gating, and disabled experts are met, inaccessible domains do not affect outputs.

The evaluation is framed as architectural prevention rather than attack-based leakage estimation. On 50 Reddit domains plus 8 unseen domains, the reported performance shows $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$4 perplexity with one accessible domain, $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$5 average improvement with two accessible domains, $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$6 average perplexity with all 50 accessible domains, and up to $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$7 improvement on unseen domains (Tiwari et al., 2023). Overhead is reported as $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$8 for next-word latency, $$\operatorname{Bel}(A)=\sum_{B\subseteq A}m(B), \qquad \operatorname{Pl}(A)=\sum_{B: B\cap A\neq\emptyset}m(B).$$9 for next-phrase latency, $m_{\text{pre}}$0 worst-case for 500-token paraphrasing, and approximately $m_{\text{pre}}$1 memory overhead across 3 GPUs parallel with $m_{\text{pre}}$2. The paper does not run membership-inference or analogous leakage attacks; excess information flow is treated as a property to be ruled out by design.

5. Causality, localization, and dynamical systems

A major controversy concerns whether common information-theoretic quantities actually measure information flow. The critique of transfer entropy argues that transfer entropy and causation entropy do not quantify flow, because they can both overestimate flow and underestimate influence (James et al., 2015). In the paper’s notation,

$m_{\text{pre}}$3

The decisive examples are XOR systems. In a two-process system $m_{\text{pre}}$4, transfer entropy is $m_{\text{pre}}$5 bit even though neither $m_{\text{pre}}$6 nor $m_{\text{pre}}$7 alone carries information about $m_{\text{pre}}$8; the dependence is purely synergistic. In a three-process lagged XOR, pairwise transfer entropy can be $m_{\text{pre}}$9 while the joint influence is $m_{\text{post}}$0 bit, whereas conditioned causation entropy assigns that joint bit to one source. The core objection is that conditioning is not subtractive; it can add synergy. In this sense, excess information flow is over-attribution produced by dyadic conditional mutual information.

A different line of work derives information flow ab initio for mappings and dynamical systems and proves a strong causality property: if the evolutionary law of $m_{\text{post}}$1 is independent of $m_{\text{post}}$2, then the information flow from $m_{\text{post}}$3 to $m_{\text{post}}$4 is zero (Liang, 2015). For linear stochastic systems,

$m_{\text{post}}$5

the resulting formula is

$m_{\text{post}}$6

This is the setting in which the paper states analytically that causation implies correlation, while correlation does not imply causation. Here an “excess” flow interpretation is not a separate formal category; rather, unusually large asymmetric $m_{\text{post}}$7 identifies strong directional influence under a measure with the stated causality theorem.

A third dynamical-systems perspective ties information flow to divergence in phase space. For a system

$m_{\text{post}}$8

the continuity formulation yields explicit dependence of entropy and mutual-information rates on $m_{\text{post}}$9. The operational definition of excess information flow is the part of the change in informational dependence generated explicitly by phase-space divergence, beyond advective propagation under an incompressible baseline (Kumar, 2023). For two variables,

$W_h$0

This assigns a concrete “excess” term to compressibility-induced information creation or destruction.

6. Harm-based security and strategically ineffective leakage

A further reframing appears in strategic security theory. Here excess information flow is leakage beyond classical noninterference that remains strategically ineffective: it does not increase the adversary’s ability to harm the system’s core goal (Jamroga et al., 2016). Security is defined not as the absence of all leakage, but as the absence of leakage that gives the Low side a surely winning strategy against the system objective $W_h$1.

The framework constructs a minimal noninterference idealization $W_h$2 of a system $W_h$3 and defines effective information security by

$W_h$4

Leakage is excess when noninterference fails but the attacker gains no new winning strategy: $W_h$5 This is a categorical departure from bit-counting or channel-capacity views. A leak can violate classical noninterference and still be “excess” in the sense of being strategically ineffective. Conversely, a small but decisive leak is not excess if it enables a winning attack.

The phone-banking case studies illustrate the distinction. In one model, publication of the grandmother’s maiden name violates noninterference but does not help Low authenticate to the bank account, so the leak is strategically ineffective. In the other, publication of the mother’s maiden name yields a surely winning authentication strategy, so the leak is strategically effective (Jamroga et al., 2016). The distinction is goal-relative and adversary-strategy-relative rather than purely informational.

7. Information thermodynamics: excess versus housekeeping

In information thermodynamics, excess information flow is not pathological. It is a formal component of information flow that captures nonstationary changes in correlations, distinguished from housekeeping flow that maintains correlations under nonequilibrium circulation (Maekawa et al., 26 Sep 2025, Ito et al., 28 Dec 2025). For autonomous bipartite Markov jump systems with mutual-information potential $W_h$6, the information flow from subsystem $W_h$7 is

$W_h$8

Using the geometric projection of the thermodynamic force onto the conservative subspace, the flow decomposes as

$W_h$9

The key identities are

$$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$0

Thus only excess information flow contributes to the time derivative of mutual information, while housekeeping flow is antisymmetric and maintains steady correlations.

For overdamped Langevin systems, the same decomposition is expressed through a Poisson equation for a geometric potential $$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$1, with excess force $$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$2 and housekeeping force $$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$3 (Ito et al., 28 Dec 2025). The excess component admits an optimal-transport interpretation via generalized $$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$4-Wasserstein geometry of marginal distributions. This leads to generalized second-law inequalities, thermodynamic uncertainty relations, and speed limits incorporating excess information flow.

An earlier continuous-time feedback-cooling analysis derived the trajectory-level information current

$$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$5

and established fluctuation theorems and the inequality $$GJS(m_1,m_2)=2\,GS\Bigl(\tfrac{m_1+m_2}{2}\Bigr)-GS(m_1)-GS(m_2),$$6 (Rosinberg et al., 2016). That paper does not explicitly introduce a housekeeping/excess split, but it identifies the boundary term as the canonical transient contribution and motivates later decompositions. A related information-geometric decomposition of entropy production into excess and housekeeping parts is always well-defined, including for systems with odd variables and nonlinear systems without steady states (Kolchinsky et al., 2022). This provides the geometric background for the later explicit decompositions of information flow itself.

Taken together, these thermodynamic works use “excess information flow” in a sharply different sense from security or causal-diagnostics literatures. Here it is not the part to be eliminated, but the conservative, transient contribution that changes mutual information and supports exact geometric, variational, and transport-theoretic characterizations.