Illusion: Safeguarding Topology Confidentiality in LLM Multi-Agent Systems via Behavior-Preserving Obfuscation

Yiu-Fai Cheung; Hongzhi Guo; Miao Pan; Irwin King; Hao Wang

cs.CROct 31, 2026

Illusion: Safeguarding Topology Confidentiality in LLM Multi-Agent Systems via Behavior-Preserving Obfuscation

Authors: Yiu-Fai Cheung, Hongzhi Guo, Miao Pan, Irwin King, Hao Wang

Organizations: The Chinese University of Hong Kong · University of Nebraska-Lincoln · University of Houston · Stevens Institute of Technology

Abstract

The communication topology of Large Language Model Multi-Agent Systems (LLM-MASs) governs how information propagates among agents and encodes critical domain knowledge and expert workflow design. It is valuable intellectual property and plays a decisive role in system utility and safety, yet remains vulnerable to inference attacks that stealthily reconstruct it from agent outputs. Existing defenses detect or mitigate such attacks but do not proactively conceal the topology itself. We propose Illusion, a proactive topology obfuscation defense for LLM-MAS. Illusion injects fake edges and fake messages to present attackers with a deceptive topology, while selecting low-impact candidates that preserve output-distribution equivalence and task-accuracy non-inferiority. The resulting fake edges are designed to be indistinguishable from genuine messages under black-box observation. Extensive experiments show that Illusion reduces edge-level F1 from over 0.87 to 0.62 and graph similarity from over 0.94 to 0.71. It also largely preserves output distributions and task performance, and its fake edges resist both similarity-based and LLM-judge filtering, even under adaptive pruning.

Figures & tables

Fig. 1: Illustration of the risk of topology inference attack. Topology inference attacks Wu et al. (2026) against LLM-MAS exploit semantic cues from outputs to infer the communication topology. This leads to IP leakage and poses severe safety risks, motivating the need to protect and conceal the topology of LLM-MAS.

Fig. 2: The overview of Illusion . (a) Illusion contain three stages. It operates by generating prompts for candidate fake edges, then ranking each candidate based on its effect on the receiver agent via probing, and iteratively injects the best fake edge candidate, verifying that the addition does not degrade task performance or alter the output distribution. (b) We demonstrate that the resulting obfuscated topology of Illusion achieves effectiveness , harmlessness and indistinguishability .

Fig. 3: Defense effectiveness. Comparison of topology inference performance on F1 and GSim.

Model	Topology	MMLU	GSM8K	GPQA
Llama-3.1-8B	Chain	0.0210 [0.0094, 0.0336]	0.0092 [0.0011, 0.0175]	0.0034 [-0.0055, 0.0125]
	Tree	0.0018 [-0.0060, 0.0095]	-0.0010 [-0.0087, 0.0066]	0.0007 [-0.0063, 0.0079]
	Star	0.0013 [-0.0050, 0.0076]	0.0080 [-0.0005, 0.0170]	+0.0020 [-0.0061, 0.0106]
Qwen-3.5-9B	Chain	0.0051 [-0.0028, 0.0133]	-0.0056 [-0.0131, 0.0025]	0.0102 [-0.0013, 0.0229]
	Tree	-0.0054 [-0.0126, 0.0021]	0.0208 [0.0095, 0.0331]	0.0036 [-0.0037, 0.0113]
	Star	-0.0034 [-0.0103, 0.0035]	0.0099 [0.0033, 0.0167]	-0.0006 [-0.0071, 0.0063]

Table 1: Defense harmlessness. Results of equivalence testing on the output distribution of the LLM-MAS with margin

\delta=0.05

. The test is formulated in §4.3.1 .

Llama-3.1-8B
Topology	MMLU	GSM8K	GPQA
Chain	60.02 $\to$ 63.45	82.10 $\to$ 86.50	27.20 $\to$ 29.66
Tree	62.95 $\to$ 63.28	86.80 $\to$ 87.20	31.11 $\to$ 30.69
Star	63.77 $\to$ 62.89	87.40 $\to$ 87.70	28.80 $\to$ 26.81
Qwen-3.5-9B
Chain	85.47 $\to$ 86.28	93.80 $\to$ 92.80	74.89 $\to$ 75.03

Table 2: Defense harmlessness. Average task accuracy (%) before and after fake edge injection. Green cells indicate that non-inferiority was demonstrated at

\delta=0.05

; red cells indicate that non-inferiority was not demonstrated.

Fig. 4: Defense indistinguishability. Classification performance of a similarity-based filter and an LLM-judge filter in distinguishing fake edges from genuine messages.

Fig. 5: Defense indistinguishability. Topology inference performance under adaptive attack using similarity-based filter and LLM-judge filter.

Fig. 6: Topology inference performance against the number of fake edges.

Fig. 7: Defense effectiveness and indistinguishability (case study) Topology inference performance evaluated on a case study using Qwen-3.5-9B on MetaGPT. The topology inference performance under adaptive attack using similarity-based filter and LLM-judge filter are also illustrated.

Topology	Output distribution	Task performance
MetaGPT	0.0008 [-0.0075, 0.0097]	73.40 $\to$ 73.30

Table 3: Defense harmlessness (case study). Harmlessness results for Qwen-3.5-9B on MetaGPT, evaluated on HumanEval. Output distribution equivalence and non-inferiority of task performance (pass rate) are both established at

\delta=0.05

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Component	Setting
Development set	$n_{\text{dev}}$ =30
Test set	$n_{\text{test}}$ =100
No. of execution	$k=10$
Fake edge prompts	$K_{p}=2$
Temperature	$0.7$
Budget	$B=3$

Appendix

Table 4: Implementation parameters.

Fig. 8: Examples of topologies, fake edge injection, and topology inference results. The left column shows the real edges and fake edges. The prediction of CIA and GPT-5.4 are also illustrated, where green edges are correctly predicted while red edges are wrong prediction.

Model	Topology	Method	Sim. bound
Llama-3.1-8B	MMLU	Chain	0.024
		Star	0.025
		Tree	0.029
	GSM8K	Chain	0.031
		Star	0.040
		Tree	0.028

Appendix

Table 5: No-effect controls. Under no defense, the largest absolute endpoint of the 90% CI for the output-similarity effect (“Sim. bound”).

Model	Topology	Method	Acc. half-width
Llama-3.1-8B	MMLU	Chain	0.029
		Star	0.028
		Tree	0.029
	GSM8K	Chain	0.029
		Star	0.023
		Tree	0.024

Appendix

Table 6: No-effect controls. Under no defense, the 95% CI half-width for the task-accuracy difference (“Acc. half-width”).

Model	Dataset	Topology	$\bar{\Delta}$ 95% CI
Llama-3.1-8B	MMLU	Chain	0.034 [0.003, 0.067]
		Star	-0.009 [-0.035, 0.017]
		Tree	0.003 [-0.026, 0.034]
	GSM8K	Chain	0.044 [0.015, 0.073]
		Star	0.003 [-0.019, 0.024]
		Tree	0.004 [-0.020, 0.028]

Appendix

Table 7: Task-accuracy non-inferiority. Paired accuracy difference

\bar{\Delta}

and its 95% CI.

Panel of Table 8 — Table 8: Prompt template for LLM-based topology inference. The prompt is adopted and modified from CIA ( Wu et al., 2026 ) .

Panel of Table 9 — Table 9: Prompt template for LLM-judge filter to aims to filter fake messages from the message transcript.

Panel of Table 10 — Table 10: Prompt template for generating the candidate prompts for fake message generation.

Multi-Agent System Security

Multi-agent system security studies attacks, trust, privacy, and defenses in interacting AI agents, including language-model teams, robot swarms, and learned controllers.

See all 188 papers

Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection
Sep 29, 2026Longzhu He, Zelang Wen, Xinfeng Li +2Multi-Agent LLM Systems Multi-Agent System Security
Nanyang Technological University · Beijing University of Posts and Telecommunications · The Hong Kong Polytechnic University
WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference
Mar 11, 2026Zixun Xiong, Gaoyi Wu, Lingfeng Yao +3Multi-Agent System Security Multi-Agent LLM Systems
Department of Electrical and Computer Engineering, Stevens Institute of Technology · Department of Electrical and Computer Engineering, University of Houston
CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems
Apr 14, 2026Yongxuan Wu, Xixun Lin, He Zhang +5Multi-Agent System Security Multi-Agent LLM Systems
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China · Griffith University, Brisbane, Australia +2

Sep 29, 2026J/K move · Enter open · S save

Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection

Longzhu He, Zelang Wen, Xinfeng Li, Sen Su+1

Nanyang Technological University · Beijing University of Posts and Telecommunications · The Hong Kong Polytechnic University

Multi-Agent LLM Systems Multi-Agent System Security

Open paper AskPDF arXiv

Driven by the rapid advancement of large language models (LLMs), LLM-based multi-agent systems (MAS) have emerged as a powerful paradigm for collaborative reasoning over complex tasks. A key design element of MAS is the communication topology, which governs information flow among agents and often encodes proprietary knowledge about the system architecture. However, recent work has shown that such topologies can be inferred even in black-box settings by exploiting semantic dependencies in observable reasoning traces, posing significant risks of intellectual property leakage and exposure of system vulnerabilities. To address this threat, we propose MIRAGE, a topology-concealment framework that preserves the genuine communication topology for task execution while shaping adversary-facing semantic evidence toward a carefully constructed phantom topology. Specifically, MIRAGE operates in three stages: (1) phantom topology synthesis, (2) semantic edge realization, and (3) protected MAS execution. It constructs a phantom topology structurally distinct from the genuine one, materializes phantom edges as plausible semantic dependencies, and suppresses source-specific cues that could reveal genuine edges absent from the phantom topology. Extensive experiments across three topology optimization frameworks and four benchmark datasets demonstrate that MIRAGE substantially reduces the effectiveness of topology inference attacks while largely preserving the task utility of the protected MAS.

Abstract

Multi-Agent System Security

Explore similar work

Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection

WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference

CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems