Leakage-Free State Prediction

• Leakage-Free State Prediction is a framework ensuring that predicted, transmitted, or controlled states remain uncontaminated by unauthorized, non-causal information.
• It unifies diverse methodologies—from information-theoretic leakage metrics and quantum side-channel removal to temporal and label leakage controls in machine learning.
• The approach guides system design in areas such as channel coding, quantum key distribution, and deep learning, ensuring reliable performance and robust data integrity.

Searching arXiv for papers on leakage-free state prediction and closely related formulations. arxiv_search(query="leakage-free state prediction OR state leakage prediction", max_results=10) Leakage-free state prediction, as suggested by several otherwise distinct research literatures, denotes prediction, transmission, or control schemes in which the inferred or communicated state is not contaminated by information that lies outside the intended causal, temporal, architectural, or physical interface. In the cited work, leakage may mean $L_e(c)=\frac1n I(S^n;Y^n)$ in a state-dependent channel, a suppressed image sideband in continuous-variable quantum key distribution, transitions out of a target quantum state, label leakage in knowledge tracing, temporal leakage in cascade evaluation, private information exposed in chain-of-thought traces, or secret data transiently propagated through microarchitectural predictors (Treust et al., 2018, Hajomer et al., 2022, Jing et al., 2021, Badran et al., 23 Aug 2025, Peng et al., 29 Oct 2025, Batra et al., 11 Nov 2025, Schwarz et al., 2019).

1. Conceptual scope

Across these literatures, “state” has several technical meanings: a random channel state $S$, a coherent-state displacement $\alpha_k$, the amplitude of a target quantum state $P(t)$, a student’s latent knowledge trajectory inferred from interaction history, the evolving state of an information cascade, the predicted-risk/outcome law $\mathrm{Law}((p,y))$, or the hidden architectural and transformer states that mediate execution and reasoning. The unifying constraint is that a predictor, controller, or communication system should neither exploit illegitimate information nor expose state information through unintended channels (Treust et al., 2018, Hajomer et al., 2022, Jing et al., 2021, Badran et al., 23 Aug 2025, Peng et al., 29 Oct 2025, Jacobs, 9 Jun 2026, Schwarz et al., 2019, Batra et al., 11 Nov 2025).

Domain	State notion	Leakage mechanism or control
State-dependent channels	$S^n$	$L_e(c)=\frac1n I(S^n;Y^n)$, empirical coordination
CV-QKD	$|\alpha_k\rangle$	Baseband IQ modulation removes the image tone
Quantum control	$P(t)=\langle A(t)|X(t)\rangle$	Suppress the kernel $g'(t,s)$ with $S$0
Knowledge tracing	$S$1, $S$2	MASK label prevents intra-question label leakage
Cascade prediction	$S$3	Time-ordered splitting prevents future information leakage
Output-only auditing	$S$4	Unit-purity head, ENB, AUC ceiling
Systems and LLMs	register taint, hidden activations	dummy forwarding or steering vectors

A further commonality is methodological. Some formulations make leakage a first-class objective in the optimization or achievability region, as in rate–equivocation–coordination theory. Others remove a physical side-channel, redesign the evaluation protocol to respect chronology, or intervene directly in hidden state. This suggests that leakage-free state prediction is best treated not as a single theory, but as a family of constraints on what information may be used, inferred, or revealed.

2. Information-theoretic formulations: masking, coordination, and state inference

In state-dependent communication, the basic setup is a memoryless channel with input $S$5, output $S$6, and random state $S$7 drawn i.i.d. $S$8. Under causal state knowledge, the encoder symbol satisfies $S$9; under strictly-causal state knowledge, $\alpha_k$0. The decoder observes $\alpha_k$1, produces a message estimate $\alpha_k$2, and may generate an action sequence $\alpha_k$3 so that the joint empirical frequency of $\alpha_k$4 is forced close to a target $\alpha_k$5 (Treust et al., 2018).

The principal leakage metric is

$\alpha_k$6

A leakage level $\alpha_k$7 is achievable if $\alpha_k$8. The same framework incorporates empirical coordination and the “core of the receiver’s knowledge,” captured by $\alpha_k$9, where $P(t)$0 and $P(t)$1 are auxiliary variables. Mutual-information terms involving $P(t)$2 then quantify what the decoder can infer about $P(t)$3 (Treust et al., 2018).

For causal encoding, Theorem II.3 states that a triple $P(t)$4 is achievable if and only if there exist auxiliaries $P(t)$5 and a joint law

$P(t)$6

such that

$P(t)$7

with cardinality bounds $P(t)$8 (Treust et al., 2018). In this formulation, leakage-free prediction is not absolute invisibility; it is the controlled selection of an achievable leakage level consistent with reliability and empirical coordination.

The coding construction uses a Block-Markov structure. The encoder quantizes the previous block’s state sequence into a bin index $P(t)$9, chooses an index $\mathrm{Law}((p,y))$0 so that $\mathrm{Law}((p,y))$1 are jointly typical, and sends codeword $\mathrm{Law}((p,y))$2 drawn i.i.d. from $\mathrm{Law}((p,y))$3. The decoder recovers $\mathrm{Law}((p,y))$4 by joint-typicality, reconstructs $\mathrm{Law}((p,y))$5, and learns the bin of $\mathrm{Law}((p,y))$6. Balancing the message, binning, and coordination rates yields $\mathrm{Law}((p,y))$7 while achieving $\mathrm{Law}((p,y))$8 (Treust et al., 2018).

The framework extends to two-sided state information and noisy feedback. In the former, one replaces the leakage term by $\mathrm{Law}((p,y))$9 and the sum constraint by $S^n$0. In the latter, the rate becomes

$S^n$1

while the same leakage bound $S^n$2 and overall $S^n$3 remain. The paper also formulates a zero-sum channel-state estimation game in which the encoder seeks to maximize the decoder’s distortion, with Sion’s theorem yielding a saddle point and a single distortion–rate function $S^n$4 (Treust et al., 2018).

3. Physical side-channel removal in continuous-variable quantum key distribution

In continuous-variable QKD based on coherent states, a state-preparation side-channel was identified in the form of information leakage about the transmitted quantum state during modulation. The modulation leakage-free architecture of (Hajomer et al., 2022) removes this vulnerability by abandoning RF up-conversion and using a baseband modulation approach with an in-phase and quadrature modulator for state preparation, radio frequency heterodyne detection, and carefully designed digital signal processing for state measurement.

Alice begins with two real classical waveforms $S^n$5 and $S^n$6, each carrying independent Gaussian random variables drawn from $S^n$7. Instead of up-converting $S^n$8 to an RF frequency $S^n$9 and generating an optical single-sideband at $L_e(c)=\frac1n I(S^n;Y^n)$0, Alice drives a dual-nested Mach–Zehnder IQ modulator directly with baseband voltages

$L_e(c)=\frac1n I(S^n;Y^n)$1

so that no RF up-conversion is performed and the optical carrier remains at the laser frequency $L_e(c)=\frac1n I(S^n;Y^n)$2. In the small-signal limit, allowing for DC-bias errors $L_e(c)=\frac1n I(S^n;Y^n)$3 and finite carrier suppression $L_e(c)=\frac1n I(S^n;Y^n)$4, the modulator output is

$L_e(c)=\frac1n I(S^n;Y^n)$5

Crucially, there is no second “image” tone at $L_e(c)=\frac1n I(S^n;Y^n)$6; the entire classical waveform $L_e(c)=\frac1n I(S^n;Y^n)$7 rides at the single optical frequency $L_e(c)=\frac1n I(S^n;Y^n)$8 (Hajomer et al., 2022).

After attenuation to the quantum level, each symbol interval $L_e(c)=\frac1n I(S^n;Y^n)$9 yields an approximate coherent state $|\alpha_k\rangle$0 with

$|\alpha_k\rangle$1

In phase space,

$|\alpha_k\rangle$2

where $|\alpha_k\rangle$3 is the shot-noise unit. The prepared ensemble is

$|\alpha_k\rangle$4

with covariance matrix

$|\alpha_k\rangle$5

For a Gaussian channel of transmittance $|\alpha_k\rangle$6 and excess noise $|\alpha_k\rangle$7, Bob’s variance is

$|\alpha_k\rangle$8

and the joint covariance matrix $|\alpha_k\rangle$9 has diagonal block $P(t)=\langle A(t)|X(t)\rangle$0 and correlation block $P(t)=\langle A(t)|X(t)\rangle$1, repeated for $P(t)=\langle A(t)|X(t)\rangle$2 (Hajomer et al., 2022).

The security proof works in the asymptotic limit with reverse reconciliation. The key rate per use is

$P(t)=\langle A(t)|X(t)\rangle$3

For a Gaussian attack,

$P(t)=\langle A(t)|X(t)\rangle$4

where

$P(t)=\langle A(t)|X(t)\rangle$5

and

$P(t)=\langle A(t)|X(t)\rangle$6

Thus,

$P(t)=\langle A(t)|X(t)\rangle$7

Because no image sideband is ever created, Eve cannot steal any extra tone, and the ideal security proof of Gaussian-modulated CV-QKD is restored with no extra side-channel terms (Hajomer et al., 2022).

The receiver DSP performs whitening of electronic plus vacuum noise spectra; frequency-offset recovery via a strong pilot tone at $P(t)=\langle A(t)|X(t)\rangle$8; carrier-phase tracking using an unscented Kalman filter; high-pass filtering at $P(t)=\langle A(t)|X(t)\rangle$9 with a 5th-order Butterworth response; and root-raised-cosine matched filtering with roll-off $g'(t,s)$0, followed by down-sampling to $g'(t,s)$1. The implementation used a CW $g'(t,s)$2 laser with $g'(t,s)$3 linewidth, $g'(t,s)$4, AWG and ADC at $g'(t,s)$5, a $g'(t,s)$6 SMF channel with physical loss $g'(t,s)$7, experimentally inferred $g'(t,s)$8, excess noise $g'(t,s)$9, and shot-noise clearance $S$00. With an 8-dimensional MET-LDPC code of base code rate $S$01, punctured for $S$02 at $S$03, the frame-error rate was $S$04. For finite-size composable security, $S$05 states yielded a secret-key fraction $S$06 over $S$07 (Hajomer et al., 2022).

4. Leakage-free paths in quantum dynamics and control

A distinct quantum use of the concept appears in the derivation of an exact one-component equation of motion for the probability amplitude of a chosen target time-dependent state. Starting from the general linear equation

$S$08

one selects a one-dimensional $S$09-subspace spanned by a normalized target state $S$10, defines $S$11, and lets $S$12 denote the complementary components. Writing

$S$13

yields

$S$14

Integrating out $S$15 with propagator $S$16 and $S$17 gives

$S$18

and hence

$S$19

Defining $S$20 and factoring $S$21, one obtains the one-component equation

$S$22

(Jing et al., 2021).

In this formulation, all leakage out of the target path is encoded in the kernel $S$23. The leakage-elimination operator is introduced by decomposing the Hamiltonian or super-operator into block-diagonal and block-off-diagonal parts, $S$24 and $S$25, and adding

$S$26

Because $S$27 and $S$28, the added term “parity kicks out” the off-diagonal leakage $S$29 nonperturbatively. Here $S$30 is an arbitrary bounded real-valued control function (Jing et al., 2021).

A sufficient condition for keeping the system on the target path $S$31 is

$S$32

Equivalently, with

$S$33

one seeks the phase factor $S$34 to be sufficiently rapidly oscillating on $S$35 so that, by the Riemann–Lebesgue lemma,

$S$36

This produces the paper’s “universal leakage-free path” condition for both closed and open systems (Jing et al., 2021).

The framework unifies several standard control limits. In the $S$37-pulse limit of $S$38, one recovers bang–bang parity kicking. Replacing fast kicks by repeated projective measurements $S$39 yields the quantum Zeno limit. In an adiabatic frame, the kernel acquires rapidly oscillating factors $S$40, and the usual adiabatic condition $S$41 appears as the requirement that the oscillatory integral vanish. The same control term can therefore accelerate adiabatic passage by effectively enlarging the phase accumulation (Jing et al., 2021).

Two explicit examples were given. For a two-level system with

$S$42

adding $S$43 in the lab frame shifts $S$44, and choosing $S$45 so that $S$46 is large and oscillatory suppresses the kernel and enforces accelerated adiabatic following. For a pure-dephasing spin coupled to a bosonic bath, parity kicks $S$47 multiply the kernel by $S$48, and if this phase oscillates rapidly on the bath correlation time, the qubit remains in $S$49 with unity probability (Jing et al., 2021).

5. Leakage-free predictive modeling in machine learning

In machine learning, leakage-free state prediction is typically a question of respecting temporal causality in evaluation and preventing labels from re-entering the input representation. One line of work treats temporal leakage in information cascade popularity prediction. Another addresses label leakage in Knowledge Tracing, where a student’s future performance is predicted from a sequence of past interactions (Peng et al., 29 Oct 2025, Badran et al., 23 Aug 2025).

For information cascades, the central criticism is that random cascade-based splits allow models to access future temporal patterns, yielding unrealistic results. The proposed remedy is a strict chronological partition of the event timeline $S$50 into four equal-length, non-overlapping intervals with boundaries $S$51. Training input uses $S$52 and training target $S$53; validation uses $S$54 and $S$55; test uses $S$56 and $S$57. The target is the incremental popularity

$S$58

CasTemp represents each propagation event $S$59 as $S$60, processes self-cascade and cross-cascade temporal walks with a bidirectional GRU, applies attention with time-aware decay $S$61, and augments the resulting representation with a competition graph encoder based on Jaccard edge weights

$S$62

The popularity predictor is an MLP with a Softplus output and MSLE objective (Peng et al., 29 Oct 2025).

Under time-ordered splits, CasTemp achieved MSLE $S$63 versus the best baseline $S$64 on Twitter, $S$65 versus $S$66 on Weibo, $S$67 versus $S$68 on APS, and $S$69 versus $S$70 on Taoke. For Taoke conversion prediction, the results were MSLE $S$71 versus $S$72, MALE $S$73 versus $S$74, and Hit@40 $S$75 versus $S$76. Per-epoch training time on Twitter was $S$77 for CasTemp, compared with $S$78 for CasFlow and $S$79 for CasDo, amounting to up to $S$80 speedup (Peng et al., 29 Oct 2025).

In Knowledge Tracing, Badran and Preisach describe the task using interactions $S$81, with $S$82, or at the knowledge-concept level $S$83 after expanding each question through a mapping $S$84. Leakage arises when a question maps to multiple KCs and the true label for one KC becomes visible while predicting another KC from the same question. The proposed remedy reserves a special label $S$85. If a question expands to several KCs, all earlier KCs receive $S$86 and only the final KC retains the true label: $S$87 The input embedding becomes

$S$88

This is complemented by Recency Encoding, where $S$89 is mapped via learnable Fourier features

$S$90

and then projected by an MLP into the model embedding space (Badran et al., 23 Aug 2025).

The method was integrated into DKT, DKT+, AKT, and SAKT. On ASSIST09 and CorrAS09, the masked variants substantially altered performance relative to leakage-prone baselines: DKT improved from $S$91 to $S$92 on ASSIST09 and from $S$93 to $S$94 on CorrAS09; AKT improved from $S$95 to $S$96 on ASSIST09 and from $S$97 to $S$98 on CorrAS09; SAKT improved from $S$99 to $\alpha_k$00 on ASSIST09 and from $\alpha_k$01 to $\alpha_k$02 on CorrAS09. Adding recency further improved masked variants, including AKT-ML$\alpha_k$03 from $\alpha_k$04 to $\alpha_k$05 on ASSIST and DKT-ML$\alpha_k$06 from $\alpha_k$07 to $\alpha_k$08 on Duolingo (Badran et al., 23 Aug 2025).

Taken together, these works formalize two distinct but related constraints. Temporal leakage violates the chronology of the prediction task. Label leakage violates the conditional information set of the learner. Leakage-free state prediction in ML therefore depends both on the split protocol and on the embedding or feature-construction pipeline.

6. Output-only auditing and the limits of leak detection

A complementary question is whether leakage can be detected from predictions and outcomes alone. In binary prediction, the decision-theoretic framework of (Jacobs, 9 Jun 2026) treats any leakage diagnostic as a functional of the joint law

$\alpha_k$09

which, under calibration, factorizes as

$\alpha_k$10

Net benefit at threshold $\alpha_k$11 is

$\alpha_k$12

and integrating $\alpha_k$13 against a density $\alpha_k$14 yields

$\alpha_k$15

where

$\alpha_k$16

The weighting density tunes sensitivity to leakage that appears only in particular risk ranges (Jacobs, 9 Jun 2026).

The central impossibility theorem concerns broad-calibrated leakage. If a leaky model is post-hoc recalibrated so that it exactly matches an honest model’s calibration and discrimination, then no statistic on $\alpha_k$17 can distinguish them. The reasoning is that a calibrated law is fully determined by the score marginal $\alpha_k$18, and for any such $\alpha_k$19 one can honestly generate exactly that law by drawing a baseline covariate $\alpha_k$20, sampling $\alpha_k$21, and reporting $\alpha_k$22. Therefore broad calibrated leakage is output-indistinguishable from honest performance unless an external $\alpha_k$23 ceiling is supplied (Jacobs, 9 Jun 2026).

What leakage cannot hide is a near-deterministic subgroup. Sorting predictions $\alpha_k$24, the cumulative top-$\alpha_k$25 purity is

$\alpha_k$26

and the unit-purity head is

$\alpha_k$27

with slack $\alpha_k$28. The purity-ceiling lemma states that if the outcome is not prediction-time-deterministic, then every honest predictor must satisfy $\alpha_k$29 for all $\alpha_k$30 that represent a non-null fraction of the population. A sustained region with $\alpha_k$31 over $\alpha_k$32 therefore certifies near-deterministic leakage (Jacobs, 9 Jun 2026).

All detectors sort in $\alpha_k$33 and then scan in $\alpha_k$34. The unified algorithm computes $\alpha_k$35, the spike head $\alpha_k$36, the AUC $\alpha_k$37, and a dispersion statistic

$\alpha_k$38

with $\alpha_k$39, and returns a verdict among clean or leaky together with a miscalibration warning. On UK Biobank with time-windowed comorbidity leakage of known graded severity, the measured detection floor was $\alpha_k$40 on that endpoint; the paper emphasizes that this numerical floor is cohort- and endpoint-specific, whereas the structural lesson is general (Jacobs, 9 Jun 2026).

This yields a trichotomy. Miscalibrated leakage is detectable but evadable by recalibration. Broad-calibrated leakage requires an external discrimination ceiling. Deterministic or near-label leakage admits a prior-free detector. A plausible implication is that “leakage-free” cannot always be certified from outputs alone; in some regimes it is identifiable only through the data-generation and modeling protocol.

7. Internal-state interventions: speculative execution and reasoning traces

A broader systems perspective appears in work that prevents leakage by constraining the evolution of internal state rather than only the final prediction. In microarchitecture, ConTExT targets transient execution, where poisoned predictors or deferred faults allow secret data to influence microarchitectural side-effects. The specific structures considered are the Pattern History Table and Branch History Buffer, the Branch Target Buffer, the Return Stack Buffer, and store-to-load dependency speculation in the Reorder Buffer and Store Buffer. ConTExT’s principle is that secrets can enter registers, but not transiently leave them (Schwarz et al., 2019).

The mechanism is a co-design of minimal hardware extensions and small compiler/OS changes. A non-transient bit $\alpha_k$41 is added to each page-table entry and TLB entry, one taint bit is added to each architectural register, and each data-cache line receives $\alpha_k$42 extra bits to record register spills. Taint propagation follows

$\alpha_k$43

$\alpha_k$44

$\alpha_k$45

If a $\alpha_k$46-op is transient and any source has $\alpha_k$47 or $\alpha_k$48, the hardware forwards a canonical dummy value, such as zero, rather than the real secret. The resulting non-interference invariant is that $\alpha_k$49 whenever $\alpha_k$50 and $\alpha_k$51 differ only in non-transient pages. Reported overheads included $\alpha_k$52 on OpenSSL-RSA-encrypt under ConTExT-light, $\alpha_k$53 CPU cycles per syscall, $\alpha_k$54 per process startup, and $\alpha_k$55 slow-down in Bochs-simulated full ConTExT on realistic mixed workloads (Schwarz et al., 2019).

In LLMs, the leakage target shifts from microarchitectural side-effects to reasoning traces. SALT addresses contextual privacy leakage in chain-of-thought by steering hidden activations away from “leaky” directions via a single additive edit at test time. For an input $\alpha_k$56, leakage is measured by an indicator $\alpha_k$57 for whether the reasoning trace reveals inappropriate private details, and the Contextual Privacy Leakage metric is

$\alpha_k$58

Utility is measured by

$\alpha_k$59

where $\alpha_k$60 indicates a correct or coherent final answer. High-leakage layers are identified via Cohen’s $\alpha_k$61,

$\alpha_k$62

and layer density

$\alpha_k$63

For each layer, the steering vector is the normalized mean-difference $\alpha_k$64, and at inference

$\alpha_k$65

Across QwQ-32B, Llama-3.1-8B, and DeepSeek-R1-Distill-Qwen-1.5B, leakage rose in the final $\alpha_k$66–$\alpha_k$67 of blocks, peaking a few layers before the output head. SALT reduced CPL from $\alpha_k$68 to $\alpha_k$69 on QwQ-32B, from $\alpha_k$70 to $\alpha_k$71 on Llama-8B, and from $\alpha_k$72 to $\alpha_k$73 on DeepSeek-1.5B, with corresponding MOU changes from $\alpha_k$74 to $\alpha_k$75, $\alpha_k$76 to $\alpha_k$77, and $\alpha_k$78 to $\alpha_k$79 (Batra et al., 11 Nov 2025).

These systems differ in threat model and mechanism, but they share a common architectural intuition. Leakage is controlled by modifying the trajectory of hidden state itself: taint bits and dummy forwarding in a speculative processor, or activation steering at a selected layer and token in a transformer. This suggests that one important meaning of leakage-free state prediction is not merely output sanitization, but intervention on the internal pathways by which state becomes predictive or externally observable.