If you keep some data secret from an AI, can it still work out where the hidden edges are?

This explores whether keeping some data out of an AI proposer's view (held-out slices, protected tests, private categories) stops it from working out where the boundaries sit. The corpus has no note testing that exact setup. The nearest evidence points one way: hiding works when it is built into the structure, and it leaks when the boundary can be probed or pieced together.

Hiding works best when the model can't reach the data at all. Can routing mask future experts to prevent knowledge leakage? pre-trains experts on disjoint two-year slices and masks any expert whose window postdates the query. That cuts future-knowledge errors by about 15% and guarantees strict causal validity. The partition is enforced by routing, so it doesn't depend on the model behaving well. The authorization-boundary notes point the same way. Naming a prohibition wasn't enough, and protected tests stayed untouched only when explicit rules were paired with restricted tools (Can explicit authorization boundaries prevent agents from modifying protected tests?). There is a catch: that result bundles rules and tools together. Nobody has shown whether the tools being unavailable or the agent choosing not to cross did the work (Do authorization rules or restricted tools prevent test modifications?).

Hiding the data is not the same as hiding the boundary. In Can attackers evade skill scanners by refining individual skills?, attackers never needed to see inside the scanners. Feedback on each attempt let them refine every sub-skill until they reached 96% average attack success. Every accept or reject a proposer receives is a measurement of where the line is. A hidden partition that still answers yes or no to proposals is only partly hidden.

Isolation also erodes when observers compare notes. A coalition that shares observations never gets worse at telling decoys from genuine objects, so defenders can't rely on isolation against coordinated observers (Does sharing observations help coalitions detect decoys better?). The reverse also holds. Splitting a task across specialized agents lets harmful intent spread over steps that each look benign, with harm appearing only in the composition (Can task decomposition hide harmful intent across agents?). A proposer that sees only its own slice can still contribute to a result no single slice reveals. More broadly, a filter judges one output at one moment, while an agent's risk spreads across memory, tool calls, and environmental reach. Containment means controlling what the agent can touch (Can a model-level filter truly contain an agent with environment access?).

Taken together, these notes suggest partition-hiding holds only under three conditions: the hiding is enforced by architecture or tools rather than by instruction, proposers get no per-attempt feedback that reflects the hidden part, and separate proposers can't pool what they see. If any one fails, the boundary can be learned. Hiding also has a price. In Do reasoning traces actually expose private user data?, anonymizing private data out of reasoning traces degraded model utility, which suggests the data was doing real work for the model.