CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems

Yongxuan Wu; Xixun Lin; He Zhang; Nan Sun; Kun Wang; Chuan Zhou; Shirui Pan; Yanan Cao

cs.AIApr 14, 2026

CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems

Authors: Yongxuan Wu, Xixun Lin, He Zhang, Nan Sun, Kun Wang, Chuan Zhou, Shirui Pan, Yanan Cao

Organizations: Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China · Griffith University, Brisbane, Australia · Nanyang Technological University, Singapore ·

Abstract

LLM-based Multi-Agent Systems (MAS) have demonstrated remarkable capabilities in solving complex tasks. Central to MAS is the communication topology which governs how agents exchange information internally. Consequently, the security of communication topologies has attracted increasing attention. In this paper, we investigate a critical privacy risk: MAS communication topologies can be inferred under a restrictive black-box setting, exposing system vulnerabilities and posing significant intellectual property threats. To explore this risk, we propose Communication Inference Attack (CIA), a novel attack that constructs new adversarial queries to induce intermediate agents' reasoning outputs and models their semantic correlations through the proposed global bias disentanglement and LLM-guided weak supervision. Extensive experiments on MAS with optimized communication topologies demonstrate the effectiveness of CIA, achieving an average AUC of 0.87 and a peak AUC of up to 0.99, thereby revealing the substantial privacy risk in MAS.

Figures & tables

Figure 1: Illustration of inferring the communication topology. The adversary infers the communication topology under a black-box setting, resulting in a severe Vulnerability Exposure that enables adversaries to pinpoint critical agents for targeted attacks and IP Threat that leaks valuable proprietary assets of developers.

Figure 2: The overview of CIA. CIA first induces the final output that reveals the reasoning outputs of intermediate agents by crafting adversarial queries. CIA then infers the communication topology by modeling semantic correlations among these outputs using global bias disentanglement and LLM-guided weak supervision.

Dataset	Method	MMLU			GSM8K			SVAMP			HumanEval
Dataset	Method	AUC	ACC	F1	AUC	ACC	F1	AUC	ACC	F1	AUC	ACC	F1
G-Designer	GPT-5	0.5833	0.8033	0.3084	0.6274	0.5887	0.4555	0.6272	0.7876	0.6815	0.6201	0.5211	0.3204
	Gemini-2.5-Pro	0.6869	0.7900	0.3697	0.6152	0.5728	0.4545	0.6300	0.7600	0.7059	0.6318	0.5541	0.3899
	Llama-3.1-8B-Instruct	0.5995	0.7157	0.4156	0.5284	0.5348	0.4689	0.4567	0.6252	0.4361	0.4922	0.4626	0.2863
	Mistral-7B-Instruct-v0.2	0.5192	0.7555	0.2889	0.4105	0.4260	0.2866	0.4977	0.6704	0.4351	0.4893	0.4430	0.2811
	CIA (Ours)	0.8324	0.8147	0.7761	0.8585	0.8382	0.7744	0.8561	0.8083	0.7682	0.7594	0.7362	0.6566

Table 1: Comparison of inference attack performance between CIA and baselines.

Dataset	G-Designer		AGP		ARG-Designer
Dataset	$N_{avg}$	$E_{avg}$	$N_{avg}$	$E_{avg}$	$N_{avg}$	$E_{avg}$
MMLU	7.0	8.99	6.0	10.87	5.42	7.84
GSM8K	5.0	8.19	5.0	8.45	3.07	3.14
SVAMP	5.0	8.15	5.0	8.41	3.05	3.10
HumanEval	6.0	11.38	6.0	11.54	4.24	5.49

Table 2: Statistical details of generated communication topologies. We report the average number of nodes (

N_{avg}

) and edges (

E_{avg}

) for each setting.

Panel of Figure 3 — Figure 3: Comparison of MAS utility (measured by Accuracy) between Std.Query and Adv.Query .

Dataset	G-Designer		AGP		ARG-Designer
Dataset	Rec	R-L	Rec	R-L	Rec	R-L
MMLU	0.90	0.89	0.89	0.88	0.93	0.93
GSM8K	0.92	0.91	0.91	0.91	0.96	0.95
SVAMP	0.92	0.92	0.93	0.92	0.95	0.94
HumanEval	0.87	0.87	0.88	0.87	0.93	0.92

Table 3: Output recovery effectiveness via Adv. Query.

G-Designer	MMLU	GSM8K	SVAMP	HumanEval
CIA w/o GBD	0.5264	0.5391	0.5308	0.5115
CIA	0.8324	0.8585	0.8561	0.7594

AGP	MMLU	GSM8K	SVAMP	HumanEval
CIA w/o GBD	0.5274	0.5683	0.5857	0.5252
CIA	0.8411	0.8804	0.8979	0.7480

Table 4: Impact of GBD on attack performance (AUC).

Figure 5: Precision of Top-

k

high-confidence edges.

G-Designer	MMLU	GSM8K	SVAMP	HumanEval
CIA w/o LWS	0.7856	0.8042	0.7852	0.7348
CIA	0.8324	0.8585	0.8561	0.7594

AGP	MMLU	GSM8K	SVAMP	HumanEval
CIA w/o LWS	0.7960	0.8243	0.8471	0.7061
CIA	0.8411	0.8804	0.8979	0.7480

Table 5: Impact of LWS on attack performance (AUC).

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: An illustrative example of $\mathcal{S}(q^{*})$ .

G-Designer	MMLU	GSM8K	SVAMP	HumanEval
CIA-Sub	0.7432	0.7689	0.7455	0.6509
CIA	0.8324	0.8585	0.8561	0.7594

AGP	MMLU	GSM8K	SVAMP	HumanEval
CIA-Sub	0.7181	0.7625	0.7964	0.6622
CIA	0.8411	0.8804	0.8979	0.7480

Appendix

Table 6: AUC comparison between CIA-Sub and CIA.

Panel of Figure 7 — Figure 7: A case study of the communication topology generated by G-Designer on MMLU.

Panel of Figure 8 — Figure 8: A case study of the communication topology generated by AGP on MMLU.

Panel of Figure 9 — Figure 9: A case study of the communication topology generated by ARG-Dsigner on MMLU.

Figure 10: Hyperparameter analysis of CIA.

Panel of Table 7 — Table 7: Prompt template for LLM-guided weak supervision.

Panel of Table 8 — Table 8: Prompt template for baseline models to infer the communication topology of MAS.

Multi-Agent System Security

Multi-agent system security studies attacks, trust, privacy, and defenses in interacting AI agents, including language-model teams, robot swarms, and learned controllers.

See all 179 papers

Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection
Sep 29, 2026Longzhu He, Zelang Wen, Xinfeng Li +2Multi-Agent LLM Systems Multi-Agent System Security
Nanyang Technological University · Beijing University of Posts and Telecommunications · The Hong Kong Polytechnic University
WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference
Mar 11, 2026Zixun Xiong, Gaoyi Wu, Lingfeng Yao +3Multi-Agent System Security Multi-Agent LLM Systems
Department of Electrical and Computer Engineering, Stevens Institute of Technology · Department of Electrical and Computer Engineering, University of Houston
When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems
May 1, 2026Lingxi Zhang, Guangtao Zheng, Hanjie ChenAdversarial Attacks Language Model Robustness
1Rice University · University of Virginia

Sep 29, 2026J/K move · Enter open · S save

Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection

Longzhu He, Zelang Wen, Xinfeng Li, Sen Su+1

Nanyang Technological University · Beijing University of Posts and Telecommunications · The Hong Kong Polytechnic University

Multi-Agent LLM Systems Multi-Agent System Security

Open paper AskPDF arXiv

Driven by the rapid advancement of large language models (LLMs), LLM-based multi-agent systems (MAS) have emerged as a powerful paradigm for collaborative reasoning over complex tasks. A key design element of MAS is the communication topology, which governs information flow among agents and often encodes proprietary knowledge about the system architecture. However, recent work has shown that such topologies can be inferred even in black-box settings by exploiting semantic dependencies in observable reasoning traces, posing significant risks of intellectual property leakage and exposure of system vulnerabilities. To address this threat, we propose MIRAGE, a topology-concealment framework that preserves the genuine communication topology for task execution while shaping adversary-facing semantic evidence toward a carefully constructed phantom topology. Specifically, MIRAGE operates in three stages: (1) phantom topology synthesis, (2) semantic edge realization, and (3) protected MAS execution. It constructs a phantom topology structurally distinct from the genuine one, materializes phantom edges as plausible semantic dependencies, and suppresses source-specific cues that could reveal genuine edges absent from the phantom topology. Extensive experiments across three topology optimization frameworks and four benchmark datasets demonstrate that MIRAGE substantially reduces the effectiveness of topology inference attacks while largely preserving the task utility of the protected MAS.

Abstract

Multi-Agent System Security

Explore similar work

Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection

WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference

When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems