Interlock: Proving a secret moved, instead of guessing that it might
17 hours ago
- Interlock detects exfiltration by chaining individually authorized tool calls, which static scanners miss.
- It uses two observation planes: an MCP proxy and an eBPF sensor, with a correlation engine for session state.
- Verdict (EXFIL, SUSPICIOUS) and action (block, contain) are separate dimensions; only EXFIL triggers hard enforcement.
- Detection relies on byte overlap of precomputed encodings, not model judgment, achieving 100% EXFIL detection in tests with 0% false positives at that tier.
- Semantic exfiltration (secrets conveyed in prose without byte form) is not detected; this is a known gap.
- Overhead: ~536 µs on sensitive reads and ~118 µs on sink checks, with read cost dominating due to encoding precomputation.
- Key lessons: build false-positive corpus early, separate verdict and action types, and measure before optimizing.