When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems

Sunday Oyinlola Ogundoyin; Muhammad Ikram

cs.CROct 12, 2026

When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems

Authors: Sunday Oyinlola Ogundoyin, Muhammad Ikram

Organizations: Macquarie University Sydney, NSW, Australia

Abstract

Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to one authorized agent can propagate through routine coordination to an unauthorized one, without compromise or malicious behavior. This motivates topology-aware enforcement that blocks unauthorized propagation while preserving authorized disclosure. We evaluate 485 scenarios across coordinator-worker, peer-to-peer, and hierarchical topologies, instrumenting seven communication channels and measuring surface leakage and disclosure to topology-introduced recipients. We introduce RECONS, a Detect -> Decide -> Transform sanitizer conditioning intervention on recipient and execution context rather than sensitivity alone. Topology changes where protected information propagates, with disclosure to topology-introduced recipients rising from 0% to 52.2% while surface leakage stays nearly flat at 60.6-62.8%. This effect persists across four generator models and a second orchestration framework, though magnitude and relay paths differ; framework choice separately drives a 150x leakage spread, so topology alone is not sufficient. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction. Detection coverage is the dominant bottleneck, accounting for 95.5% of residual disclosures. These results show that privacy enforcement in MALS must reason about the recipient and communication path realized at runtime, not sensitivity or topology assumptions alone.

Figures & tables

Figure 1. Overview of the experimental pipeline: configuration (corpus, topology, and authorization policy), execution (framework and model sweeps), and evaluation (detection, RECONS sanitization, and cross-condition analysis).

	Topology	Recipient-	Benign threat	Propagation
	varied	conditioned	model	control
AgentLeak ( Yagoubi et al., 2026 )	✗	✗	✓	✗
MAMA ( Liu et al., 2026 )	✓	✗	✗	✗
Biswas et al. ( Biswas et al., 2025 )	✓	✗	✗	✗
PrivacyChecker ( Wang et al., 2025 )	✗	✗ †	✓	✗
1-2-3-Check ( Li et al., 2025 )	✗	✗	✓	✗

Table 1. Comparison with the closest prior measurement and defense work. A benign threat model measures organic propagation; propagation control means the mechanism acts on where a value is headed, not only whether it is sensitive.

Value type $\tau$	Sensitive by	Admitted transformation
Format-dependent	recognizable format	format-preserving encryption
Value-dependent	the information carried	pseudonymization / mLDP
Contextual	meaning in context	semantic rewriting / redaction

Table 2. Protected-value taxonomy, defined by admitted transformation.

Stratum	Resolving mechanism	Instances	Share
Certain-positive	Tier 1/2 exact or structured match	70,280	57.5%
Semantic-middle	Tier 3 judge	36,568	29.9%
Certain-negative	No deterministic signal	15,372	12.6%
Total		122,220	100.0%

Table 3. Stratification of the 122,220 evaluation instances.

$\zeta$	FPR	FNR	Accuracy	Precision	Recall	$F1$
0.35–0.60	0.0112	0.0625	0.9833	0.9091	0.9375	0.9231
0.61–0.70	0.0112	0.0937	0.9799	0.9062	0.9062	0.9062
0.71–0.80	0.0112	0.1875	0.9699	0.8965	0.8125	0.8525
0.81–0.85	0.0112	0.2187	0.9665	0.8926	0.7812	0.8333
0.86–0.90	0.0075	0.2500	0.9665	0.9231	0.7500	0.8276
0.91–0.95	0.0037	0.3750	0.9565	0.9524	0.6250	0.7547

Table 4. Tier-3 threshold calibration on the main semantic-middle sample (299 instances, 32 leaks).

Figure 2. Surface leakage rate (%) by topology and adversary level. Each cell contains the proportion of the 485 scenarios exhibiting at least one unauthorized disclosure.

Figure 3. Recipient-conditioned exposure (%) by topology and adversary level. New-agent disclosure is the primary topology-conditioned leakage measure

L(T)

. Unauthorized propagation includes any recipient outside the authorized set.

Effect	Metric	$\chi^{2}$	$\mathrm{df}$	$p$
Topology	New-agent	191.8	4	$2\times 10^{-40}$
Topology	Propagation	94.2	5	$9\times 10^{-19}$
Adversary	New-agent	16.0	2	$3\times 10^{-4}$
Adversary	Propagation	9.3	2	$9\times 10^{-3}$

Table 5. Cochran’s

Q

tests for topology and adversary-intensity effects on recipient-based disclosure.

Scope	$T_{1}$	$T_{3}$	$T_{5}$	$T_{10}$	$T_{20}$
Behavioral ( $C_{1}$ / $C_{2}$ / $C_{6}$ / $C_{7}$ )	0.020	0.213	0.230	0.250	0.321
All channels ( $C_{1}$ – $C_{7}$ )	0.020	0.237	0.251	0.281	0.349
Tool only ( $C_{3}$ / $C_{5}$ )	0.000	0.057	0.057	0.081	0.089

Table 6. Cumulative disclosure: mean number of distinct protected values disclosed per trajectory across nested horizons. Values are judge-scored and pooled over

\tau/\tau^{\prime}

(

n=970

Scope	$T_{1}$	$T_{1}{\to}T_{3}$	$T_{3}{\to}T_{5}$	$T_{5}{\to}T_{10}$	$T_{10}{\to}T_{20}$
Behavioral ( $C_{1}$ / $C_{2}$ / $C_{6}$ / $C_{7}$ )	19	188	16	19	69
All channels ( $C_{1}$ – $C_{7}$ )	19	211	13	30	66
Tool only ( $C_{3}$ / $C_{5}$ )	0	55	0	24	7

Table 7. Marginal first-time disclosures by horizon transition. Counts denote trajectories with a newly disclosed protected value among

970

trajectories; re-disclosures are excluded.

Archetype	Disclosures	Turns	Rate
G (confirmation probe)	574	2,212	0.259
F (rapport)	78	2,916	0.027
B (handoff)	97	4,101	0.024
E (closeout)	62	2,643	0.023
C (justification)	67	3,761	0.018
BASE (initial task)	19	1,777	0.011

Table 8. Disclosure by interaction archetype in the all-channel scope. Rate is the fraction of turns of each archetype that disclose the protected value.

Axis	Eligible	Raw positives	Single_src
Inference	2,954	22	39.5%
Cross-channel	3,195	25	33.0%
Cross-agent	172,949	503	87.2%

Table 9. Reconstruction results by aggregation axis. All positives were manually audited; emergent recovery is zero on every axis.

Horizon	Real accuracy	Real advantage	Shuffled advantage
$T_{1}$	0.502	$+0.002$	$-0.000$
$T_{3}$	0.531	$+0.031$	$-0.008$
$T_{5}$	0.566	$+0.066$	$-0.002$
$T_{10}$	0.537	$+0.037$	$-0.000$
$T_{20}$	0.500	$+0.000$	$-0.004$

Table 10. Pairwise distinguishability by horizon. The

T_{5}

signal does not survive the confound analysis below.

Horizon	Real advantage	Shuffled null
$T_{1}$	$+0.367$	$-0.018$
$T_{3}$	$+0.346$	$-0.008$
$T_{5}$	$+0.342$	$-0.015$
$T_{10}$	$+0.338$	$-0.007$
$T_{20}$	$+0.207$	$-0.011$

Table 11. Order-invariant control: real matched pairs vs. synthetic re-pairings.

Framework	Raw leakage	Policy-filtered leakage	Value fidelity
AutoGen	43.85%	43.38%	87.15%
LangChain	25.54%	25.50%	25.59%
LangGraph	23.75%	23.71%	26.40%
CrewAI	21.61%	21.01%	27.75%
Semantic Kernel	1.56%	0.67%	67.11%
LlamaIndex	0.72%	0.50%	36.23%

Table 12. Leakage and value fidelity across eight orchestration frameworks, sorted by policy-filtered leakage.

Figure 4. Leakage rates across observable channels on all frameworks.

Framework	Temp. 0.0	Temp. 0.2 ( $\Delta$ )	Temp. 0.5 ( $\Delta$ )	Temp. 0.7 ( $\Delta$ )
AutoGen	43.38	43.34 ( $-$ 0.04)	43.41 (+0.03)	43.25 ( $-$ 0.13)
LangChain	25.50	25.59 (+0.09)	25.69 (+0.19)	25.87 (+0.37)
LangGraph	23.71	23.79 (+0.08)	23.90 (+0.19)	23.93 (+0.22)
CrewAI	21.01	21.40 (+0.39)	21.04 (+0.03)	21.41 (+0.40)
Semantic Kernel	0.67	0.82 (+0.15)	0.82 (+0.15)	0.84 (+0.17)
LlamaIndex	0.50	0.45 ( $-$ 0.05)	0.49 ( $-$ 0.01)	0.41 ( $-$ 0.09)

Table 13. Policy-filtered leakage (%) across four independently generated corpora. Deltas are relative to the temperature-

0.0

corpus of record.

Figure 5. New-agent disclosure rate by topology cell across four generator models under LangGraph (

n=485

scenarios per cell). Exposure magnitude and cell ordering vary across generators in richer topology cells.

Figure 6. New-agent disclosure rate by topology cell for LangGraph and AutoGen over the full corpus (

n=485

per cell), using the same Qwen3-32B generator. Topology-introduced exposure occurs in every richer cell in both frameworks, but its magnitude and topology-specific ordering differ.

Hier-7 executions	AutoGen	LangGraph
Direct-access	34.0% [29.2,39.2], $n{=}341$	55.9% [50.2,61.4], $n{=}297$
Relay-required	2.8% [1.1,7.0], $n{=}144$	60.3% [51.6,68.4], $n{=}126$
Observed pattern	strong attenuation	no comparable attenuation

Table 14. Realized-path decomposition of new-agent disclosure in Hier-7, measured from each framework’s

C_{2}

execution traces. Rates are reported with 95% Wilson confidence intervals (CI). The analysis is conditional on a defined disclosing agent (423 LangGraph executions, 485 AutoGen executions).

Topology cell	Relay-failure rate
Hier-7	8.5%
CW-7	12.2%
P2P-4 / P2P-7 / P2P-10	0.0%

Table 15. AutoGen relay-failure rate by topology cell. The P2P cells require no relay.

Figure 7. RECONS recipient-conditioned privacy enforcement. The sensitive information detector identifies what may be sensitive in the message. Policy decision engine determines what to do based on who can receive it and in what context. The sanitization module modifies the message according to the decision. Trace & audit logger provides transparency and supports post-hoc auditing.

Value type	Recall	Caught / total
Value-sensitive	85.0%	731 / 860
Format-sensitive	65.1%	1023 / 1571
Context-sensitive	36.0%	299 / 831
Overall	62.9%	2053 / 3262

Table 16. Pre-tuning detection recall by value type over 3,262 positive instances.

Channel	Kind	Recall
$C_{2}$ (inter-agent)	free-text	85.3%
$C_{6}$ (logs)	free-text	83.7%
$C_{7}$ (artifacts)	mixed	79.3%
$C_{1}$ (final output)	free-text	73.7%
$C_{4}$ (tool outputs)	mixed	71.6%
$C_{5}$ (memory writes)	structured	40.5%

Table 17. Pre-tuning recall for format-sensitive values across channels, isolating channel representation from value-type composition.

	Static- $\mathcal{A}$	Dynamic- $\mathcal{A}$
Under-sanitization	2.39%	0.00%
should-sanitize, allowed ( $/2{,}092$ )	50	0
Over-sanitization	0.00%	0.00%
should-allow, sanitized ( $/17$ )	0	0

Table 18. Decision correctness on the detected, recipient-resolvable development subset (

n=2{,}109

). Dynamic-

\mathcal{A}

eliminates the 50 topology-induced under-sanitization cases observed under Static-

\mathcal{A}

Metric	Result
Decided action: FPE / mLDP / rewrite	18 / 50 / 35
Rewrite outcome: first-attempt clear / redaction fallback	27 (77.1%) / 8 (22.9%)
Detector-based $P$ -removal	103/103 (100%)
FPE round-trip: corpus / synthetic	18/18 + 27/27
FPE character-set preservation	45/45
FPE length preservation	41/45

Table 19. Transformation-layer verification on the development sample (

n=103

). FPE checks combine 18 corpus-occurring and 27 synthetic cases; other rows are scoped to the indicated sample or corpus population.

Condition	Residual leakage $\downarrow$	Correct-allow $\uparrow$
None	96.7%	0.0%
Presidio (DLP)	35.5%	34.7%
AgentLeak blanket redaction	28.3%	20.5%
RECONS	29.25%	94.1%

Table 20. End-to-end results on the held-out set (405 scenarios; 2,430 scenario–cell runs; 34,884 protected-value occurrences). Residual leakage is lower-is-better; correct-allow is higher-is-better.

Cause	Count	Share
Detection miss (never flagged)	9,657	95.5%
Field-level fallback (no resolvable recipient)	452	4.5%
Post-transformation detector-positive	7	0.07%
Total	10,116	100%

Table 21. Decomposition of RECONS’s 10,116 residual cases. Detection misses dominate; field-level fallback is the principal RECONS-specific source.

Value type	Residual leakage
Value-dependent	17.6%
Format-dependent	23.3%
Contextual	55.7%

Table 22. RECONS residual leakage by protected-value type. Contextual values exhibit the highest residual exposure, consistent with weaker contextual detection.

Figure 8. Residual leakage by observable channel.

C_{3}

exhibits the highest residual leakage across the sanitizing conditions; RECONS trails blanket redaction on every channel except

C_{1}

and

C_{2}

Condition	CW-2	CW-7	P2P-4	P2P-7	P2P-10	Hier-7
None	0%	98.0%	97.9%	98.0%	97.6%	97.8%
Presidio ( Stack, )	0%	34.2%	34.7%	35.1%	35.8%	35.0%
Blanket Redaction ( Yagoubi et al., 2026 )	0%	26.7%	27.0%	25.5%	25.9%	26.5%
RECONS	0%	25.9%	26.9%	25.1%	25.4%	26.5%

Table 23. Disclosure to topology-introduced agents before and after sanitization.

RECONS, by value type:
Condition	Utility
AgentLeak blanket redaction	99.3%
Presidio (DLP)	97.3%
RECONS (redact-only ablation)	98.8%
RECONS	83.5%
Format-dependent (FPE)	91.6%

Table 24. Content-level meaning-preservation proxy by condition (stratified sample,

n=120

; 40 per value type) and by value type for RECONS. The proxy does not fully characterize structured-field usability or task-level utility.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Archetype	Working definition
BASE (initial task)	The trajectory’s opening turn, in which the acting agent is given the task and the protected value.
A (elaboration)	A turn adding detail or context to a prior statement, without being directly asked to confirm or reveal the protected value.
B (handoff)	A turn transferring the task, case, or context to another agent.
C (justification)	A turn explaining or defending a decision or recommendation.
D (error handling)	A turn responding to or correcting a mistake or inconsistency earlier in the trajectory.
E (closeout)	A turn concluding the trajectory or interaction, e.g. summarizing the outcome.

Appendix

Table 25. Interaction archetypes used in trajectory construction.

Attribute	Disclosure rate
SSN / DOB / phone / email / account	0.0%
Salary / balance / credit score	0.0%
Address	0.9%
Settlement amount	3.7%
Confidential strategy	27.6%
Internal notes	36.4%

Appendix

Table 26. Gemini-3.7-Flash Hier-7 disclosure rates by protected attribute type. Structured identifiers exhibit lower observed disclosure rates than contextual and narrative attributes.

Multi-Agent LLM Systems

Multi-agent large language model systems coordinate multiple AI agents to solve tasks through communication, specialization, shared tools, and memory.

See all 1,032 papers

MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
Aug 3, 2026Jinghan Xu, Longze Fan, Zeyuan Wang +2Multi-Agent LLM Systems LLM Agent Security
1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1
Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems
May 26, 2026Aman Priyanshu, Supriti Vijay, Esha PahwaAI Agent Safety Benchmarks Multi-Agent LLM Systems
Foundation AI · USA · Corvic AI
Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs
Aug 29, 2026Yian Wang, Agam Goyal, Eshwar Chandrasekharan +1Privacy Leakage in Language Models Multi-Agent LLM Systems
Siebel School of Computing and Data Science University of Illinois Urbana-Champaign Urbana, IL, USA

Aug 3, 2026J/K move · Enter open · S save

MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication

Jinghan Xu, Longze Fan, Zeyuan Wang, Xinjin Li+1

1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China+1

Multi-Agent LLM Systems LLM Agent Security Information Flow Control Privacy Protection for LLM Agents

Open paper AskPDF arXiv

Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream. We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes. A reference monitor enforces these scopes across subsequent operations, while a history-aware extension accounts for inference risk accumulated over repeated disclosures. Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal. Under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. Two-backbone MAGPIE executions further show that mediated disclosures propagate through subsequent planning, tool use, coordination, and memory retrieval. These results support scope-bound semantic declassification as a practical communication boundary for private LLM-agent systems.

Abstract

Multi-Agent LLM Systems

Explore similar work

MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication

Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems

Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs