The Distribution Hypothesis: Empirical Evidence That Fragment Allocation, Not Fragmentation, Determines AI Decision Protection

The Distribution Hypothesis: Empirical Evidence That Fragment Allocation, Not Fragmentation, Determines AI Decision Protection

This paper presents FLEET (Federated Leakage Evaluation & Evidence Test), the first systematic benchmark measuring reconstruction attack success against semantic fragmentation across heterogeneous large language models. Over 9,600 attack trials spanning 50 queries across 5 high-consequence verticals (finance, healthcare, legal, government, insurance), 8 attacker configurations from 6 AI providers, 8 experimental conditions, and 3 statistical runs per condition, we establish a critical distinction between fragmentation and distribution as defense mechanisms.

Key findings:

• Level 1 (Direct Attack): Fragmentation alone provides zero protection — 0 of 9,600 trials across all conditions achieve Decision Non-Reconstructability (D_A < 0.3). This holds across fragment counts k ∈ {2, 3, 4, 5} (E2), fragmentation strategies including entity-based, sentence-based, and naïve splitting (E3), decoy fragment injection (E4), and multi-agent collaborative amplification with avg similarity 0.988 (E5-L1c). Fragmentation is a necessary structural precondition for isolation, but it is non-operative as a protective mechanism in the absence of enforced fragment allocation.
• Level 2 (Collaborative Attack): Controlled fragment distribution reduces reconstruction success by two orders of magnitude — 81.3% ± 3.1% of trials achieve D_A (avg similarity 0.224).
• Residual Scope: 3 queries (6%) fail D_A consistently across all runs; an additional 7 queries (14%) exhibit stochastic failures. Together, this 20% boundary defines the precise operational scope where Layer 3 (signal neutralization) must intervene to achieve complete C2 satisfaction.
• Metric Robustness: Cross-validation against BERTScore F1 and SBERT cosine similarity confirms consistent rank ordering of query vulnerability (Spearman ρ = 0.300–0.453, p < 10⁻²⁴). Dual-threshold analysis demonstrates convergent L2 pass rates and identical consistent failure sets across metrics.

The distribution hypothesis reframes AI decision governance from "how should we fragment?" to "how should we distribute?" — with immediate implications for enterprise compliance under the EU AI Act (effective August 2026), Colorado AI Act (effective June 2026), and emerging AI governance frameworks.

Experimental scope:

• Models tested: GPT-4o, Claude Sonnet 4.5, Gemini 2.0 Flash, Grok-3, DeepSeek-V3, DeepSeek-R1, GLM-4-Plus, plus a non-ML script baseline (TF-IDF concatenation).
• Verticals: Financial Services, Healthcare, Legal, Government, Insurance.
• Methodology: 50 benchmark queries × 8 attacker configurations × 8 experimental conditions × 3 runs × 2 attack levels. Over 12,000 total trials.
• Ablation study (E2–E5): Fragment count independence (E2), strategy independence (E3), decoy ineffectiveness (E4), collaborative amplification failure (E5-L1c).

Version notes:

v2.7 consolidates internal revisions v2.5–v2.6. Major additions over v2.4: 4,350 → 9,600+ trials, E2–E5 ablation study, dual-threshold analysis (Appendix C), threshold sensitivity across 0.10–0.60, BERTScore/SBERT cross-validation, safety layer control (Script Baseline), and collaborative amplification falsification test (E5-L1c).

Seventh paper in the OIA Lab series. First empirical paper; P1–P6 are position papers and frameworks.
Series: OIA Lab — AI Decision Settlement Research
Paper ID: P7 v2.7
ORCID: 0009-0006-2124-564X