Should sanitizers re-score their compressed output before passing it?

The paper offers two remedies for the 23.4% leak in its user-prompt gate: drop the COMPRESS band at IB-0, or re-score the retained prefix and PASS only if it also stays below the threshold θ. The second is the more general idea. A transform-then-pass gate makes two claims at once: that the transformation removed the payload, and that what remains is safe. The first is an assumption about position (see Why does compression defense fail at the user prompt boundary?); the second can be checked. Re-scoring turns the assumption into a measurement by sending the sanitizer's output through the same detector as its input.

The principle travels beyond this gate: whatever a sanitizer emits should face the test its input faced. Can inspecting generated workflows catch planning-time attacks? describes FLOWGUARD, which reframes workflow-contaminating cues before the planner sees them, another transform-then-pass defense. The vault note does not say whether the rewritten output is inspected again, and the ChannelGuard result suggests asking.

The costs and unknowns are the reason this is OPEN. Re-scoring adds a scoring pass per compressed message. It helps only if the detector can see the residual payload in the prefix, and the excerpt does not say how the bands are defined beyond PASS, COMPRESS and θ. Dropping the compress band removes the gate's middle option, so messages would presumably be passed or stopped whole, and the excerpt says nothing about the false-positive or leakage cost of that. Neither fix is reported as tested, and whether either recovers the 58 leaked cases is unknown. Treat this as a design lead from the paper's authors, not a validated result.

Re-scoring also inherits the detector's blind spots. Can one compromised agent corrupt an entire multi-agent network? says the transmitted signal has no explicit semantic content, so a retained prefix of such a message would pass the second score as it passed the first, and the re-score would add nothing for that class. That reading is the vault's; no ChannelGuard gate is reported against that attack, and an open tension in ops/tensions/ holds the same limit for per-hop scoring in general.