PhantomPolicy: Handling Hidden Structures

• PhantomPolicy is a multifaceted label denoting frameworks and strategies to address hidden structural errors in diverse technical domains including LLM security, software supply chains, and risk-limiting audits.
• It employs layered defenses—ranging from template sanitization and role boundary enforcement to statistical auditing and causal privacy checks—to counter both adversarial and compliance vulnerabilities.
• Empirical evaluations demonstrate high success rates in mitigating structured template injections, phantom package imports, and context-fragmented violations across multiple benchmark settings.

PhantomPolicy is a reused label in recent technical literature rather than a single canonical framework. In the supplied corpus, it denotes a security policy and defense strategy against Structured Template Injection (STI) in agentic LLM systems; a benchmark for policy-invisible violations in LLM-based agents; a comprehensive policy and technical framework for preventing, detecting, and mitigating phantom package imports in LLM-assisted software development; a policy for handling inaccurate ballot manifests in risk-limiting audits; a multi-agent, cross-domain policy enforcement framework to prevent Context-Fragmented Violations (CFVs); a causal, empirical framework for auditing privacy risks in synthetic data releases; and, in one computer-vision usage, the strategy behind Phantom’s unified deepfake protection (Deng et al., 18 Feb 2026, Wu et al., 14 Apr 2026, Krishna et al., 31 Jan 2025, Banuelos et al., 2012, Wu et al., 24 Apr 2026, Amin et al., 15 Jun 2026, Kim et al., 30 Jun 2026). The recurrence of the term across these settings suggests a common emphasis on failure modes that are structurally real but not directly visible in the local representation available to a model, auditor, or workflow.

1. Terminological scope and recurring pattern

Across the cited works, PhantomPolicy names domain-specific mechanisms for handling “phantom” structure: injected role markers in agent prompts, hidden policy facts in enterprise workflows, hallucinated software dependencies, missing ballots in manifests, latent poisoned behaviors in models, and disclosures in synthetic data that may or may not be causally attributable to training membership.

Usage	Core meaning	Source
Agentic LLM security	Security policy and defense strategy against Structured Template Injection (STI) in agentic LLM systems	(Deng et al., 18 Feb 2026)
Single-agent compliance	Benchmark spanning eight violation categories with balanced violation and safe-control cases	(Wu et al., 14 Apr 2026)
Software supply chain	Policy and technical framework for preventing, detecting, and mitigating phantom package imports	(Krishna et al., 31 Jan 2025)
Election auditing	“Phantoms to evil zombies (~2EZ)” modification for risk-limiting audits	(Banuelos et al., 2012)
Multi-agent compliance	Multi-agent, cross-domain policy enforcement framework to prevent Context-Fragmented Violations	(Wu et al., 24 Apr 2026)
Synthetic data privacy	Causal, empirical framework for auditing privacy risks in synthetic data releases	(Amin et al., 15 Jun 2026)
Deepfake protection	Strategy behind Phantom’s unified deepfake protection	(Kim et al., 30 Jun 2026)

A plausible implication is that the label functions less as a fixed doctrine than as a naming convention for methods that correct errors caused by hidden, flattened, or misattributed structure.

2. Structured Template Injection and agent hijacking

In the STI setting, PhantomPolicy is explicitly a “security policy and defense strategy against Structured Template Injection (STI) in agentic LLM systems” (Deng et al., 18 Feb 2026). The underlying threat model assumes that agents serialize conversations as role-typed messages,

$$M = \{(r_i, c_i)\}\ \text{for}\ i = 1 \ldots n,\ \text{with}\ r_i \in \{\text{system, user, assistant, tool}\},$$

and then flatten them into a single token stream using chat templates with reserved delimiter tokens such as

$$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$

The paper’s central claim is that agent hijacking is primarily a structural—not semantic—problem. Retrieved content that contains tokens resembling or colliding with $S$ can “escape” its intended role boundary and be misparsed as a higher-privilege segment. Phantom operationalizes this by synthesizing “ghost conversation history”: prematurely terminating the current tool frame, forging an assistant completion segment, or forging the next user turn.

The attack pipeline combines multi-level template augmentation, a Template Autoencoder (TAE), and Bayesian optimization. The encoder maps a discrete template $T$ into $z \in \mathbb{R}^d$ via $e(T)=z$, and the decoder reconstructs templates with enforced $[\mathrm{SEP}]/[\mathrm{END}]$ consistency. The optimization objective is to identify

$z^* = \arg\max_z f(z),$

where $f(z)$ is a proxy success score from lightweight evaluation. Expected Improvement is used as the acquisition function:

$$EI(x) = (\mu(x)-f_{\text{best}}-\xi)\Phi(Z)+\sigma(x)\phi(Z).$$

The reported empirical effect is architectural rather than merely prompt-semantic. Average ASR is 79.76% across GPT-4.x, Qwen, Gemini, and DeepSeek benchmarked agents, compared with 54.09% for Single-Template, 39.86% for Semantic-Injection, and 38.46% for ChatInject. Delimiter Spotlighting barely reduces Phantom’s ASR, and Tag Filter leaves robust ASR via obfuscated variants. The large-scale assessment of 942 agents found 70+ confirmed vulnerabilities, including role-boundary parsing flaws, tool-output trust issues, and unsafe retrieval augmentation.

PhantomPolicy answers this threat with layered controls. The framework hardens template and role boundaries, sanitizes retrieval augmentation, constrains agent orchestration, adds model-level robustness, and institutes monitoring and red-teaming. Its formal sanitization rule is:

$$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$0

with pass-through to role-bearing fields disallowed. The reserved-token set includes role and tooling markers such as $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$1, $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$2, $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$3, $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$4, $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$5, $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$6, $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$7, and $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$8. Tool outputs are to be signed, role fields are immutable, control and data channels are separated, and red-teaming reuses Phantom’s augmentation + TAE + BO pipeline.

3. Hidden-state policy enforcement in LLM agents and multi-agent systems

A distinct usage of PhantomPolicy concerns compliance failures that occur even in non-adversarial, syntactically valid, user-sanctioned workflows (Wu et al., 14 Apr 2026, Wu et al., 24 Apr 2026). In the single-agent benchmark, a policy-invisible violation occurs when compliance depends on facts absent from the agent-visible context. The formalization distinguishes the visible context $$S = \{\langle|im\_start|\rangle, \langle|im\_end|\rangle, \langle tools\rangle, \langle tool\_call\rangle, \langle tool\_response\rangle, \langle think\rangle, \ldots\}.$$9, hidden world state $S$0, action $S$1, and policy predicate $S$2:

$S$3

A violation arises when $S$4 but $S$5.

The PhantomPolicy benchmark was constructed so that every tool output contains “clean business data”: no visible audience tags, no status fields, and no path-based hints. Its world model covers 30 contacts, 40 documents with six audience types and four sensitivity levels, 3 projects, and 4 groups. The benchmark contains 120 cases total: 60 violations and 60 safe controls, across eight categories: Context boundary, Text-output leakage, Oversharing, Audience restriction, Accumulated session leakage, Cross-context dataflow, High-value resource protection, and Temporal validity. Five frontier models were evaluated, producing 600 baseline traces and an additional 600 traces under a policy-in-prompt condition. Manual review changed 32 of 600 labels (5.3%) relative to the original case-level annotations.

Sentinel is the corresponding enforcement framework. It models the organizational world state as a typed property graph

$S$6

treats each agent action as proposed mutations $S$7, forks the graph, applies the mutations, and verifies declarative invariants. The decision function is

$S$8

Against human-reviewed trace labels, Sentinel achieves 92.99% accuracy and 92.71 F1, whereas the content-only DLP baseline achieves 68.83% accuracy and 56.61 F1 overall. The DLP baseline has high precision, approximately 96.06%, but low recall, approximately 40.13%.

The multi-agent extension generalizes the same problem from hidden state to fragmented state. A Context-Fragmented Violation is defined for a sequence $S$9 when every local step is allowed under the private graph $T$0 available to agent $T$1, yet the sequence is blocking when evaluated against the hypothetical global graph $T$2. Distributed Sentinel addresses this with zero-trust sidecars, Counterfactual Graph Simulation, and the Semantic Taint Token protocol. An STT has the form

$T$3

and propagates security labels and serialized policy predicates across domains without exposing raw graph contents.

On PhantomEcosystem, a 200-scenario benchmark with 160 attacks and 40 legitimate controls, Distributed Sentinel achieves F1 = 0.95 with 106ms end-to-end latency (16ms verification + 90ms entity extraction on A100), compared to 0.85 F1 for prompt-based filtering and 0.65 for rule-based DLP. Eight frontier LLMs exhibit substantial violation rates, 14–98%, and cross-domain data flows show systematically higher violation rates than same-domain flows. This suggests that prompt-level alignment and monolithic interceptors are poorly matched to violations whose decisive facts are absent from any one agent’s local context.

4. Phantom packages and LLM-assisted software development

In software supply-chain security, PhantomPolicy is a “comprehensive policy and technical framework for preventing, detecting, and mitigating phantom (hallucinated) package imports in LLM-assisted software development” (Krishna et al., 31 Jan 2025). A package reference is hallucinated if the package name is not registered in the appropriate repository, was first registered after the model’s knowledge cutoff date, or—when the cutoff is unknown—was first registered less than 90 days prior to the model’s first publication date. “Phantom” dependencies are therefore fictional or post-cutoff dependencies introduced into generated code.

The paper formalizes the Package Hallucination Rate (PHR) as the proportion of prompts that elicit at least one hallucinated package in the model’s output. It evaluates 11 models across JavaScript, Python, and Rust. Aggregate language-level observations are specific: JavaScript has the lowest mean PHR, $T$4, and the most consistent behavior, $T$5; Rust has mean PHR $T$6 and more models above 40% than other languages; Python has higher variance, $T$7, and the highest max PHR observed, 46.15% for Granite-3.0. Larger models, especially those at or above 70B, show significantly lower PHR, with correlation between $T$8 and PHR of $T$9 and $z \in \mathbb{R}^d$0. The inverse correlation between HumanEval and average PHR is $z \in \mathbb{R}^d$1.

The work also argues that the Pareto frontier between code generation performance and safety is sparsely populated. Nemotron-Llama-3.1-70B is near the frontier with HumanEval 83.5%, MBPP 84.9%, and avg PHR 1.76%; GPT-4o is near the frontier with HumanEval 92.1%, MBPP 86.8%, and avg PHR 5.42%. By contrast, induced hallucinations occur at nearly double the rate of natural hallucinations across languages, indicating susceptibility to adversarial prompting.

PhantomPolicy translates these findings into governance and controls. The framework assigns Security Engineering ownership of allowlists, denylists, and cutoff catalogs; Dev Leads approve new dependencies and review import diffs; Platform/DevOps enforce CI/CD gates and SBOM verification; Audit runs quarterly reviews of PHR metrics. Technical measures include registry verification against npm, PyPI, and crates.io, typosquat detection, SBOM generation, signed provenance through Sigstore or equivalent, sandboxed installs, RAG-backed package validation, and explicit policy language such as: “All LLM-generated imports must be validated against organization allowlists and public registries prior to merge. Imports first-registered post model cutoff date are prohibited unless explicitly approved.”

5. Statistical auditing, missing structure, and the meaning of phantoms

A much earlier and mathematically distinct use appears in risk-limiting audits, where the “phantoms to evil zombies (~2EZ)” modification addresses inaccurate ballot manifests (Banuelos et al., 2012, Amin et al., 15 Jun 2026). A ballot manifest lists ballot group identifiers together with the number of ballots in each group. The key observation is that it is not necessary to adjust the reported margin by the number of missing ballots in order to remain conservative. Instead, sampled-but-missing ballots are treated as worst-case substitutes: “evil zombies.”

The policy requires an upper bound $z \in \mathbb{R}^d$2 on the true total number of ballots. Auditors draw indices uniformly with replacement from $z \in \mathbb{R}^d$3, map indices through the manifest if $z \in \mathbb{R}^d$4, and treat missing or unmappable ballots as evil zombies. For ballot-polling audits, an evil zombie is treated as simultaneously showing valid votes for all reported losers. For ballot-level comparison audits, it is treated as having the maximum across-contest pairwise overstatement of 2 votes. The governing guarantee is stochastic dominance of the audit $z \in \mathbb{R}^d$5-value: “The random variable $z \in \mathbb{R}^d$6 is stochastically larger than the random variable $z \in \mathbb{R}^d$7 if, for every threshold $z \in \mathbb{R}^d$8, $z \in \mathbb{R}^d$9.” The modification makes the audit $e(T)=z$0-value stochastically larger than it would be had the manifest been accurate, ensuring that the true risk limit remains smaller than the nominal risk limit. If $e(T)=z$1 and the manifest is accurate, the policy has no effect at all on the number of ballots audited nor on the true risk limit.

In synthetic data auditing, the same vocabulary reappears in a causal privacy framework that distinguishes “true disclosures” from “phantom disclosures.” The audit partitions a corpus $e(T)=z$2 into $e(T)=z$3 and $e(T)=z$4 using Bernoulli inclusion variables $e(T)=z$5, generates synthetic output $e(T)=z$6, extracts rare features, and compares train-side and holdout-side match rates. The framework supports exact-string, PII, and semantic-reconstruction audits, and tests both zero learning and $e(T)=z$7-DP-bounded learning. For discrete matches, the statistic is

$e(T)=z$8

with zero-learning critical value

$e(T)=z$9

An empirical lower bound on privacy leakage, $[\mathrm{SEP}]/[\mathrm{END}]$0, is derived from the observed match counts.

The central conceptual distinction is causal. A true disclosure is a rare feature from a training user that appears in synthetic output in statistically significant excess over the holdout baseline; a phantom disclosure is a holdout-side or otherwise non-causal match consistent with zero learning or with the stated DP bound. The paper’s Finance SFT example reports 763 DLP PII matches with 492 train and 271 holdout, so phantoms account for over 35% of matches. This makes naive counting systematically misleading. In the reported comparisons, SFT rejects the zero-learning null across datasets for at least one feature type, whereas DP-SGD consistently fails to reject and yields $[\mathrm{SEP}]/[\mathrm{END}]$1 estimates of 0.

6. Latent policies, data poisoning, and computer-vision extensions

The term also appears in work on latent behaviors implanted by data poisoning and in proactive media protection (Draganov et al., 3 Feb 2026, Kim et al., 30 Jun 2026). In Phantom Transfer, a “phantom policy” is an internal decision bias embedded through poisoned instruction-tuning data. The hidden behavior is described as latent, distributed across stylistic and framing choices, and capable of conditional activation through a password-triggered variant. The paper demonstrates cross-model transfer from Gemma-source data into GPT-4.1, GPT-4.1-mini, Gemma-3-12B, and OLMo-2-13B; even fully paraphrasing every sample in the dataset using a different model does not stop the attack. Data-level defenses such as word-frequency filters, oracle LLM judges, and full paraphrasing all fail to eliminate the behavior, which motivates the authors’ recommendation to shift attention toward model audits and white-box security methods.

The computer-vision usage is different in object but similar in structure. There, PhantomPolicy is “the strategy behind Phantom’s unified deepfake protection.” The framework is proactive and per-image, and jointly constrains perturbations in latent and spatial domains. Given an image $[\mathrm{SEP}]/[\mathrm{END}]$2, mask $[\mathrm{SEP}]/[\mathrm{END}]$3, perturbation $[\mathrm{SEP}]/[\mathrm{END}]$4, and synthesized target $[\mathrm{SEP}]/[\mathrm{END}]$5, the protected image is

$[\mathrm{SEP}]/[\mathrm{END}]$6

subject to

$[\mathrm{SEP}]/[\mathrm{END}]$7

The total loss is

$[\mathrm{SEP}]/[\mathrm{END}]$8

The adaptive target is “identity-shifted yet attribute-preserving,” and the perturbation is confined to semantically relevant facial regions. Reported protection gains in dodging scenarios are 27.8% on UniFace, 25.6% on INSwapper, and 16.6% on SimSwap, with up to 10.2% higher protection in impersonation while improving perceptual fidelity.

Taken together, these latter usages show that PhantomPolicy can name either a governance framework or an operational strategy. A plausible implication is that the common thread is not the application domain but the treatment of hidden structure—whether that structure is a covert decision bias in a fine-tuned model or an identity-relevant direction preserved through latent and spatial constraints.