When agents start speaking their own language: how latent communication breaks the safety boundaries of large models

Researchers at CISPA Helmholtz Center for Information Security found that when multi-agent systems switch to latent communication, the overall safety alignment of the system is significantly weakened even if the underlying model parameters remain unchanged. The related paper "Safety of Latent Communication in Multi-Agent Systems" (arXiv:2609.39788) shows that training the communication adapter only on normal mathematical task data raises the combined harmful response score of a two-agent system on four safety evaluations including HarmBench from 4.4 to 31.1, and the first-token refusal probability drops from about 84% under natural language communication to about 29%. The researchers also designed three attack methods: poisoning about 10% of the training data raises the average score from 27.9 to 58.2, GRPO-based reinforcement learning optimization raises it to 76.9, and the hybrid system reaches 95.9, while accuracy on normal tasks does not drop but instead rises.