At Intrinsec AI we organise agent security around four pillars: Intent, Identity, Threat, and Policy — what we call I²TP. Most treatments handle them as disjoint concerns. We think they are aspects of a single quantity: the mutual information between a user's true goal and the agent's output, and the geometry of how that information flows through the system.
How many bits of the user's true goal survive into the output?
Along which trajectory does information travel through representation space?
Compression clears the debris — threats that hide in clutter become obvious on a clean information surface.
Every delegation should shrink the set of permissible information directions.
Let $X$ be the user's true intent, $T$ the prompt tokens, $W$ the model's weights, and $Y$ the output. The causal chain is:
Because $X \to T \to Y$ forms a Markov chain, the Data Processing Inequality (DPI) gives us a hard ceiling:
Now suppose an attacker injects malicious tokens $A$ into the prompt. The model now sees $T' = (T, A)$.
Crucially, $A$ is independent of $X$ — the attacker has no channel to the user's true goal. So:
Combining with DPI:
This is the fundamental asymmetry. The injected tokens carry zero bits about what the user wants, but they can carry many bits of influence over what the model does. A system that can distinguish "information about intent" from "influence on output" has a principled basis for filtering injections.
If intent is the amount of information, identity is its direction. Every token and every pixel in a vision-language model contributes to a persona — a trajectory through the model's representation space. Identity is not a label. It is a flow.
Think of the model's hidden states as a manifold. Normal interaction traces a path toward one attractor — the intended persona. But certain tokens are uniquely potent at bending this trajectory. Abstract, philosophical, or high-leverage tokens carry outsized directional influence because they activate broad regions of the weight space. They act as gravitational lenses, bending the information flow toward a different attractor entirely.
This view explains why role-play jailbreaks work: the attacker provides tokens that don't carry identity information (they are independent of the true user), but carry enormous directional influence. Same asymmetry as intent — zero information, high influence — but now the axis is identity rather than goal.
But engineered injections are only the sharpest form. The same geometry covers a broader class. Cognitive overload floods the context with excessive or contradictory tokens — not steering the trajectory toward a specific attractor, but destabilizing it, increasing its variance until the model's path wobbles erratically. Environmental distractions work differently still: a promotional banner on a webpage being parsed by a vision-language agent, a sponsored recommendation embedded in retrieved documents. These pixels and tokens carry zero information about the user's goal, but they inject a quiet directional bias — nudging the trajectory toward a purchase or a recommendation the user never asked for. Not a sharp hijack, but a slow bend. All three share the same fundamental asymmetry: zero mutual information with intent, nonzero influence on direction. They differ only in geometry — a targeted turn, a wobble, a drift.
Consider an HR agent with read access to a folder of W-2 forms. Each document triggers a data-access event. Without compression, the information space fills with clutter — redundant structure, irrelevant tokens, policy-violating noise. Imagine walking through ancient ruins choked with rubble and garbage. Every corridor looks the same. You cannot find a direction, let alone detect whether someone else is heading somewhere they shouldn't.
This is the uncompressed information surface: a space so cluttered that direction is undetectable. Threats don't need sophistication to hide — they just need the landscape to be messy enough that no trajectory stands out.
Compression is the path-clearing tool. It removes everything that does not serve the direction of information flow — irrelevant tokens, redundant structure, policy-violating noise — conditioned on a given policy such as the system prompt. What remains is a clean information geometry: a space you can walk through, where each corridor has distinctive landmarks and every direction is legible.
There is a striking parallel in neuroscience. When we forget, it is not typically because the values are erased — it's because we've lost the keys. In the key-value architecture of memory, forgetting is a key-retrieval failure. Memory champions counter this with the memory palace technique: they place vivid, bizarre objects along familiar paths. Each object is a manufactured key — an anchor that makes a direction memorable and navigable.
This is exactly what the compression engine does: given a policy, it sculpts the information surface into a navigable geometry. It discards what doesn't serve the intended direction and preserves what makes each direction distinguishable. The result is a space where legitimate flows follow clean, landmark-studded corridors — and a threat, by definition, is a trajectory that departs from them. The threat doesn't need to be sophisticated. It only needs a clean surface to be caught on.
The threats above — engineered injections, cognitive overload, environmental bias — assume a perturbation large enough to be detectable in a single step. But there is a subtler and more dangerous class: compositional threats, where the attack is decomposed into constituent parts, none of which individually triggers a guardrail.
An attacker breaks a harmful goal into $N$ steps. Each step $i$ induces an angular displacement $\delta_i$ from the current trajectory — a small directional change, well below the detection threshold $\epsilon$ of any point-wise guardrail:
Point-wise guardrails that evaluate each step independently face a fundamental limitation against this class of attack. Each individual perturbation looks benign — a small, innocuous directional change, indistinguishable from normal variance in the information flow. Only when viewed as a trajectory does the systematic drift become apparent.
This is the compositional attacker's strategy: stay below the per-step noise floor, but maintain coherent direction. The information-theoretic signature is distinctive: the mutual information between any single step and the attack goal, $I(\delta_i;\, G_{\text{attack}})$, is vanishingly small — each step looks like noise. But the mutual information between the full sequence and the attack goal, $I(\delta_1, \ldots, \delta_N;\, G_{\text{attack}})$, is large — the sequence is coordinated.
This is where the memory palace matters most. On the compressed, navigable geometry, a trajectory that drifts systematically — even through steps that are individually sub-threshold — traces a path that departs from the clean corridors. The memory palace doesn't just reveal sharp turns; it reveals slow, adaptive curvature. A wrong direction is detectable not because any single step is large, but because the corridor you're walking down is not one that leads anywhere safe.
In a multi-agent system, Agent A delegates to Agent B, which delegates to Agent C. Each delegation is an information channel. And here the framework gives a clean prescription: the cone of permissible information directions must narrow at every hop.
This is the information-theoretic version of least-privilege. Traditional least-privilege restricts access; I²TP restricts the angular width of the information flow. A child agent should not merely have fewer permissions — it should have fewer possible directions its information can travel. The cone narrows, and any trajectory that falls outside the cone is a policy violation by definition.
This gives us a measurable, enforceable property: at each delegation boundary, project the information flow onto the allowed cone. Anything outside is clipped. The deeper the delegation chain, the tighter the cone. Privilege escalation — the child gaining a wider cone than the parent — is detectable as a geometric anomaly before any harmful action occurs.
Because the framework is geometric, every I²TP violation is a measurable event: a departure from the DPI bound, an angular displacement in identity space, an anomalous trajectory on the compressed surface, or a cone violation at a delegation boundary.
The name Intrinsec comes from the Latin intrinsecus — looking inward. This is not just a brand. It is an information-theoretic choice, and it has consequences.
Classical security looks outward. It waits for intent to crystallize into actions, actions to produce events, events to fill logs. By the time a security system sees anything, the original intent — a compact, structured object — has expanded into a sprawling trail of downstream artifacts: network calls, file writes, API responses, audit records. The system must then work backward, sifting through this verbose output to reconstruct what the agent was trying to do.
This is a Kolmogorov complexity argument. Think of intent as a short program $p$, and all the downstream events as the output that program produces when executed. The output is long — potentially unbounded — but its Kolmogorov complexity $K(p)$, the length of the shortest program that generates it, is small. Intent is that short program.
Classical security puts all its bits into reconstructing the source program from its output — an algorithmically hard problem, often intractable. It is working at the wrong level of abstraction: high bit-count, low semantic density. Looking inward — observing intent before it expands — is working at the level of the generating program itself. Fewer bits, maximal meaning. This is not just more efficient. It is the algorithmically optimal point of observation.
The I²TP framework is not just a way of thinking about agent security — it is the geometric space in which Intrinsec AI's identity plane operates. Traditional security tools work downstream, at the event boundary. Intrinsec works upstream, inside the geometry where intent lives.
The compression engine sculpts the information surface — conditioned on your policy — creating a navigable geometry where intent is measurable, identity has direction, threats have nowhere to hide, and delegation cones are enforceable.
Every I²TP pillar maps to a concrete operation on this surface: measure mutual information for intent, track angular trajectory for identity, verify surface navigability for threat, project onto the allowed cone for policy. One geometric space. One identity plane.
Intrinsecus — looking inward. The identity plane doesn't sit downstream, reconstructing intent from the verbose trail of events and logs. It operates at the source: the information-theoretic manifold where intent forms, identity flows, threats emerge, and policy constrains. Security is not a layer bolted onto the output. It is the geometry of the space where the output is born.