# Beyond Locality: Feature-Boundary Auditing for OS-Integrated AI

arXiv: https://arxiv.org/abs/2606.10173 · HTML: https://mlsanity.com/paper/2606.10173/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 37 references that are in the map.
- First posted on arXiv 8 Jun 2026.

## Builds on (most cited first, 7 of 7)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing](https://mlsanity.com/paper/2001.00973/) (2020)
- [Text Embeddings Reveal (Almost) As Much As Text](https://mlsanity.com/paper/2310.06816/) (2023)
- [Prompt Injection Attack to Tool Selection in LLM Agents](https://mlsanity.com/paper/2504.19793/) (2025)
- [Unveiling Privacy Risks in LLM Agent Memory](https://mlsanity.com/paper/2502.13172/) (2025)
- [Towards Verifiably Safe Tool Use for LLM Agents](https://mlsanity.com/paper/2601.08012/) (2026)
- [A Vision for Access Control in LLM-based Agent Systems](https://mlsanity.com/paper/2510.11108/) (2025)

## Built on by (most cited first, 1 of 1)

- [ComBodied Agents: a New Paradigm of Human-Centric Agentic AI](https://mlsanity.com/paper/2608.10915/) (2026)

## Abstract (arXiv)

On-device inference reduces exposure to remote infrastructure, but it does not establish privacy for an operating-system assistant that aggregates cross-application data, retains derived state, or delegates actions. We present a feature-boundary audit method for OS-integrated AI. It combines a taxonomy of six privacy-failure surfaces, a five-dimension control rubric with separate evidence grades, and explicit records for adjacent data and authority paths. We apply the method to Apple Foundation Models, Apple Private Cloud Compute, Android AICore/Gemini Nano, and Microsoft Recall using primary public documentation. The analysis distinguishes request isolation from contextual restraint, retained-state controls from non-retention, and attestation from task-appropriate disclosure. A formative comparison of two 20-item assessment records identifies ambiguities in notice, retention, path ownership, and accountability. The source-linked records identify supported controls and unresolved dependencies; we also specify a minimized event record and release comparison for fleet security triage and scoped forensic review.