Secrets propagate during agent conversations: topology-driven leakage and receiver-conditional sanitization in multi-agent LLM systems

1. 01What problem does this paper attempt to solve?

   The authors state that information legitimately disclosed in multi-agent systems propagates through collaboration to unauthorized agents, and existing defenses lack recipient awareness and thus cannot balance privacy and utility.

   In multi-agent LLM systems (MALS), information legitimately disclosed to authorized agents propagates along the communication topology to unauthorized agents during routine collaboration, causing topology-driven privacy leakage.

   • Problem scenario and importance: In multi-agent systems, complex tasks are decomposed and executed collaboratively among multiple agents, which cooperate through tool calls, shared memory, and direct messages. The authors argue that information flow is no longer confined to the user and a single model, so sensitive data leakage no longer depends solely on "whether a value was disclosed" but on "whether it was passed to the wrong recipient."
   • Shortcomings of existing methods: The authors state that most existing defenses apply one-size-fits-all treatment based on sensitivity. If every detected sensitive value is treated equally, the system must make an either-or choice between "comprehensive sanitization that breaks legitimate disclosure" and "complete release that allows unauthorized propagation"; existing prompt sanitization and reasoning-based mitigation schemes target only single-message or single-user boundaries and do not determine authorization based on the forwarding recipient.
   • Core observation and hypothesis: The authors propose the concept of topology-conditioned recipient exposure, arguing that changing the communication topology changes the set of recipients that information can reach, turning originally legitimate disclosures into policy-violating leakage once propagation crosses the authorization boundary.
   • Threat model:
     • Attacker goal: As a passive unauthorized recipient, obtain protected attributes it is not authorized to access by observing communication channels exposed inside or outside the system.
     • Attacker knowledge: Observe channel contents under black-box tracing; the paper's main threat model assumes it has no ability to modify execution or inject prompts, and no cross-session correlation or collusion capability.
     • Attacker capability: Covers three levels of adversarial strength: A0 (benign execution, no active attack), A1 (external adversary observing the user's final output C1), and A2 (internal adversary observing inter-agent messages C2, tool parameters and results C3/C4, and shared memory C5).
     • Victim system: A multi-agent collaborative system running on orchestration frameworks such as LangGraph, containing multiple agents with heterogeneous roles and field-level access control policies.
   • Proposed approach: The paper proposes an evaluation framework for measuring topology-driven leakage, and the RECONS online sanitizer, which grounds privacy enforcement in the recipient and execution context resolved at runtime through a "detect-decide-transform" pipeline.

   Collapse this answer

2. 02What related research exists?

   The authors reviewed three types of research—multi-agent privacy leakage, internal channel measurement, and sanitization transformation—and pointed out that none of the existing work conditions defense interventions on the recipient boundary.

   The paper reviews related research along three dimensions and points out the differences between existing methods and this paper:

   • Privacy leakage and inference in multi-agent systems

     • CONFAIDE (2024): directly evaluates contextual-integrity reasoning and finds that the agreement between models and humans on information-flow compliance drops from 0.8 to 0.1 in complex scenarios; the authors point out that it treats disclosure as a single decision and does not consider subsequent propagation of messages.
     • PrivacyChecker (2025) and 1-2-3-Check (2025): PrivacyChecker reports a "judgment-action gap" in which models can identify sensitive content yet still leak it during interaction, and 1-2-3-Check mitigates leakage by decomposing reasoning; the authors point out that both rely on the executing model itself to judge a single message and do not condition it on the subsequent forwarding path.
     • Compositional leakage research (Patil et al., 2025; Asif and Amiri, 2026; Biswas et al., 2025): formalizes information reconstruction caused by concatenating benign outputs from multiple agents, derives information-theoretic bounds, and points out that leakage increases with topology depth and collusion; MAGPIE (2025) measures up to 56% leakage in negotiation scenarios under explicit prohibitions; GAMA (2025) and SRPG (2025) start from architectural isolation but do not associate leakage with communication graph structure or explicit recipient authorization.

   • Measurement of internal leakage in multi-agent systems

     • AgentLeak (2026): measurement finds that leakage rates for internal messages and shared memory are 2.1 times those of external outputs, that auditing only outputs would miss 41.7% of violations, and that one-size-fits-all masking causes task success rates to drop by 30–65 points; the authors point out that its limitation is that it only evaluates a fixed two-agent topology and does not study how structure changes reachable recipients.
     • MAMA (Liu et al., 2026): shows on 6 graph structures that denser, more centralized topologies and shorter attacker distances increase memory leakage; the authors point out that MAMA is based on an active threat model that actively probes memory, whereas this paper studies topology propagation under benign execution and uses the authorization relation as the baseline.
     • Other benchmarks (AgentBench, 2025; AgentDojo, 2024; OpenAgentSafety, 2025): mainly evaluate task capability, prompt injection robustness, or static privacy evaluation, and do not isolate topology as an independent variable for evaluation.

   • Data loss prevention (DLP) and privacy-preserving transformation

     • Pr∈∈mpt (2025): provides formal indistinguishability guarantees based on format-preserving encryption (FPE) and metric local differential privacy (mLDP) for a single prompt; the authors point out that its limitation is single-agent, single-user interaction, where there is no need to distinguish recipients.
     • Boundary firewalls and access control (Multi-Agent Firewall, 2026; AgentGuard, 2026): intercept before calling third parties or enforce attribute-based access control on tool calls; the authors point out that they only guard cross-boundary traffic and cannot control the flow of values already present inside the system among heterogeneous agents.
     • Dynamic label propagation (FIDES, 2025) and monitoring isolation (Sentinel, 2025): FIDES prevents prompt injection based on information-flow control; Sentinel isolates violating interactions but lacks authorization classification and utility trade-offs.

   • Baseline methods and benchmark datasets

     • Comparison baselines include no sanitization (None), AgentLeak one-size-fits-all masking (Blanket Redaction), and Microsoft's open-source data protection tool Presidio (DLP); evaluation is based on 485 multi-agent scenarios derived from the AgentLeak benchmark.

   • Positioning of this work: The authors state that this work extends multi-agent propagation measurement by isolating the topology independent variable, and fills the gap that single-agent sanitization and boundary firewalls cannot control internal unauthorized propagation by introducing a recipient-aware decision layer at the communication boundary.

   Collapse this answer

3. 03How does the paper address this problem?

   The paper proposes the RECONS online sanitizer, which uses a three-stage "detect-decide-transform" pipeline to enforce adaptive protection at the communication boundary based on recipient authorization and data type.

   For topology-driven leakage in multi-agent systems, the paper proposes RECONS (Recipient-Conditioned Sanitization), an online interception and sanitization framework. The framework decouples sensitivity from authorization, and through a three-stage Detect → Decide → Transform pipeline, it intercepts events before agent-generated content crosses a boundary, applying targeted protection based on recipient identity and contextual policy.

   Problem Formalization and Observable Channels

   • Observable event representation: An observable event is represented as a tuple \vartheta_t = (\check{a}, \varsigma, c, r, \text{pos}, t), where \check{a} is the protected attribute, \varsigma is its value type, c ∈ {C1, …, C7} is the channel, r is a resolvable recipient, pos ∈ {pos_i, pos_j} distinguishes whether the recipient is the original authorized agent or an agent introduced by the topology, and t is the time index.
   • Authorization relation and boundary crossing: The authorization relation \mathcal{A}(\check{a}, \varsigma, c, r, \text{pos}) \in \{\text{allow}, \text{sanitize}\} is formalized as the decision basis; leakage occurs when 𝒜(·) = sanitize and the protected value is obtained by an unauthorized recipient.
   • Seven observable channels: These cover the user's final output (C1), inter-agent messages (C2), tool parameters and results (C3/C4), shared memory reads and writes (C5), reasoning and execution logs (C6), and generated artifacts (C7). Only C2 and C5 read operations explicitly include a recipient identifier; the remaining channels do not include a resolvable recipient.

   Detection Layer Design

   • Three-tier progressive detection architecture: Tier 1 uses rule-based and NER pattern matching (for structured fields such as SSN, card numbers, phone numbers, and dates, as well as checksum verification); Tier 2 uses GLiNER for zero-shot entity recognition, replacing results only when confidence is higher than Tier 1; Tier 3 uses a calibrated Mistral-Small-24B as an LLM judge to detect semantically equivalent expressions on free-text channels (C1, C2, C6) and on the semantic content of C5 and C7.
   • Threshold calibration and stratification: Instances are divided into definite positives (Tier 1/2 matches), definite negatives, and a semantic middle layer; a threshold sweep is performed on an independent calibration set generated under CW-2, selecting the threshold ζ = 0.50 (at this operating point, precision is 0.9091, recall is 0.9375, and FPR is 0.0112).
   • Three classes of protected values: Protected values are divided into three classes according to the required transformation: format-dependent (e.g., account numbers, birthdays), value-dependent (e.g., names, numeric amounts), and context-sensitive (e.g., diagnoses, litigation strategy, internal memos).

   Decision Layer Design

   • Dynamic recipient authorization rule: If the resolved recipient r has access authorization, allow is executed; if not authorized, transformation is triggered. Because only C2 and C5 reads have explicit recipients, the remaining channels fall back to field-based static policy.
   • Confidence protection rule: For channels with a resolvable recipient, when detection confidence is uncertain, the default leans toward protection.
   • Discussion of topology-position extension: An extension rule based on graph reachability (i.e., sanitize if the recipient can reach an unauthorized agent) was evaluated, but because it led to an over-sanitization rate as high as 82%, it was not included in the core policy.

   Transformation Layer and Verification Mechanism

   • Type-adapted transformation operations: For format-dependent values, FF3-1 format-preserving encryption (FPE) is used, preserving the data format and supporting downstream decryption and restoration (truncation is removed for short-domain numeric values to ensure reversibility); for non-numeric value-dependent attributes, deterministic keyed pseudonymization is used, and for numeric ones, mLDP perturbation with the Laplace mechanism (ε = 1.0) is used; for context-sensitive text, semantic rewriting is performed using a frozen prompt; when all transformations fail, the system falls back to redaction.
   • Rewrite verification and fallback mechanism: Rewrite results are retried at most 3 times and verified by the detector; if still judged sensitive, the system falls back to masking; in the full evaluation, an exact-match backstop is introduced, requiring the rewrite to both pass the semantic check and not contain the original literal value.

   Collapse this answer

4. 04What experiments did the paper conduct?

   The paper evaluates the effects of topology, adversarial strength, framework, and model on leakage across 485 scenarios, and examines RECONS's performance on residual leakage and authorized retention.

   Experimental Setup

   • Models under test: The main-experiment generation model is Qwen3-32B (deployed locally via vLLM, temperature 0, fixed seed); the model generalization experiment additionally evaluated GPT-5-mini, Gemini-3.7-Flash, and Llama-3.3-70B; the judge model is Mistral-Small-24B (temperature 0, threshold ζ = 0.50), with Gemma-3-27B used for cross-validation.
   • Dataset and scenario scale: From 1,000 scenarios in the AgentLeak benchmark, 485 multi-agent scenarios were retained after filtering (138 enterprise, 100 finance, 100 healthcare, 147 legal). The test set is split into 80 development scenarios and 405 held-out test scenarios.
   • Topologies and time steps: 6 topology units were evaluated, including star (CW-2 as a 2-agent baseline reference unit, CW-7 as 1 coordinator and 6 workers), peer-to-peer mesh (P2P-4, P2P-7, and P2P-10 containing 4, 7, and 10 fully connected agents respectively), and hierarchical (Hier-7 as a two-level hierarchy). Execution time steps T ∈ {1, 3, 5, 10, 20}.
   • Orchestration frameworks: The main experiment uses LangGraph; the cross-framework experiment evaluated 8 frameworks in total: AutoGen, CrewAI, Google ADK, LangChain, LangGraph, LlamaIndex, OpenAI Agents SDK, and Semantic Kernel.
   • Adversarial levels and instance scale: Three levels are covered: A0 (benign), A1 (external C1), and A2 (internal C2–C5). The 485 scenarios under 6 topologies and 3 adversarial levels generated 8,730 execution records, with 122,220 channel-level detection instances in total.
   • Main metric definitions: Surface leakage (proportion of scenarios with at least one unauthorized disclosure); New-agent disclosure (proportion of information reaching new agents introduced by the topology); Unauthorized propagation (proportion of information reaching unauthorized recipients); Residual leakage (proportion still accessible to unauthorized recipients after sanitization); Correct-allow (proportion still accessible to authorized recipients); Value fidelity (consistency between generated values and ground-truth values).

   Main Results

   Condition	Residual leakage ↓	Correct-allow ↑
   None (no sanitization)	96.7%	0.0%
   Presidio (DLP)	35.5%	34.7%
   AgentLeak blanket redaction (one-size-fits-all masking)	28.3%	20.5%
   RECONS (this paper's method)	29.25%	94.1%

   (According to Table 20)

   • Substantial reduction in residual leakage: The authors state that RECONS reduces the residual leakage rate from 96.7% with no sanitization to 29.25%, close to blanket redaction's 28.3% and better than Presidio's 35.5%.
   • High proportion of authorized disclosures preserved: The authors state that RECONS preserves 94.1% of authorized disclosures, about 4.6 times that of blanket redaction (20.5%), indicating that it can suppress unauthorized propagation while maintaining normal business data flows.
   • The difference is concentrated in authorized scenarios: In the 395 held-out scenarios with no legitimately disclosable fields, RECONS and blanket redaction have similar residual leakage (28.0% vs. 28.4%); the gap between the two is mainly concentrated in the 10 scenarios that contain legitimately disclosable fields.

   Effect of Topology and Orchestration Framework on Leakage

   • What was tested: Leakage performance of 6 topologies under A0/A1/A2 was evaluated on 485 scenarios, along with a cross-sectional comparison and path decomposition across 8 orchestration frameworks.
   • Results: Surface leakage varies only narrowly across topologies, from 60.6% to 62.8% (Figure 2); whereas New-agent disclosure is 0% for CW-2, 34.4%–38.6% for CW-7, 43.1%–47.8% for P2P units, and reaches 49.9%–52.2% for Hier-7 (Figure 3). In the cross-framework evaluation (Table 12), AutoGen (43.38%), LangChain (25.50%), LangGraph (23.71%), and CrewAI (21.01%) form the high-leakage group, while Semantic Kernel (0.67%), LlamaIndex (0.50%), OpenAI Agents SDK (0.48%), and Google ADK (0.29%) form the low-leakage group, with the extremes differing by about 150 times. In the Hier-7 path decomposition (Table 14), AutoGen's leakage rate drops to 2.8% when relaying is required (34.0% for direct access), whereas LangGraph still reaches 60.3% when relaying (55.9% for direct access).
   • The authors' interpretation: The authors state that the core security consequence of topology is changing the set of reachable recipients rather than changing the surface disclosure rate; nominal topology does not uniquely determine leakage, and the relay semantics and state-sharing mechanisms of different orchestration frameworks independently drive the degree of leakage.

   Model Generalization and Leakage Pathway Decomposition

   • What was tested: Qwen3-32B, GPT-5-mini, Gemini-3.7-Flash, and Llama-3.3-70B were used to evaluate the generalization of the topology gradient, and information reconstruction, behavioral side channels, and temporal cumulative leakage were examined.
   • Results: Topology-induced new-agent exposure exists across all generation models (Figure 5), but on non-reference units GPT-5-mini reaches 57.1%–65.8%, Qwen3-32B 35.3%–49.9%, Llama-3.3-70B 21.4%–23.5%, and Gemini-3.7-Flash 9.3%–11.5%. Among 179,098 inference, cross-channel, and cross-agent aggregation instances, manual audit confirmed 0 cases of reconstruction leakage (Table 9); the slight advantage of behavioral side-channel discrimination at T5 was confirmed to be caused by confounding factors such as corpus generation order (Table 10/11); temporal cumulative analysis shows that 60.5%–64.0% of first disclosures are concentrated in T1→T3 (Table 7), and confirmed probe-type turns (G type) have a leakage rate of 25.9% (Table 8).
   • The authors' interpretation: The authors state that leakage mainly manifests as direct disclosure and its propagation rather than implicit reconstruction or behavioral side channels; leakage rates for different models under the same topology can differ by up to 7 times, indicating a strong interweaving effect between topology and model choice.

   Decomposition of Residual Leakage Sources and Channel Distribution

   • What was tested: The causes of the 10,116 residual leakage cases of RECONS on the held-out set were decomposed, and statistics were computed by channel and protected value type.
   • Results: Among the 10,116 residual leakage cases, detection misses (not detected) account for 9,657 (95.5%), field-level fallback for channels with no recipient accounts for 452 (4.5%), and cases where the detector still reports positive after sanitization account for 7 (0.07%) (Table 21). By value type, context-sensitive residual leakage is highest at 55.7%, format-dependent at 23.3%, and value-dependent at 17.6% (Table 22). By channel (Figure 8), tool parameter C3 has the highest residual leakage (43.9% for RECONS, 41.4% for blanket), and RECONS outperforms or matches blanket redaction only on C1 and C2 (C1: 32.5% vs. 32.6%, C2: 25.2% vs. 25.7%).
   • The authors' interpretation: The authors state that detection coverage is the dominant bottleneck limiting sanitization effectiveness, and any downstream sanitizer with the same detection capability is subject to this upper bound; tool parameters, lacking recipient identifiers, become a structural difficulty for policy protection.

   Other Ablations and Analyses

   • Dynamic policy vs. static policy: On the development set, the residual leakage rate drops from 29.81% to 29.25% (a reduction of 0.56 percentage points), eliminating 50 topology-induced unauthorized releases (Table 18).
   • Transformation menu vs. uniform masking: Under the same decisions, the residual leakage rate only rises slightly from 29.25% to 29.59%, and the authorized release rate remains unchanged at 94.1%.
   • Rewrite exact-match fallback: After introducing the exact-match check, cases where the detector reports positive after sanitization decrease from 67 to 7 (an 89.6% reduction).
   • Context-preservation proxy evaluation: Blanket redaction scores 99.3%, and RECONS scores 83.5% overall (format-dependent 91.6%, value-dependent 89.6%, context-sensitive 69.1%) (Table 24).
   • Temperature robustness check: Over the temperature range 0.0 to 0.7, the maximum drift in framework policy-filtered leakage rate does not exceed 0.41 percentage points, and the high- and low-leakage groups remain stable (Table 13).
   • AutoGen relay failure analysis: The relay failure rates for the multi-hop topologies CW-7 and Hier-7 are 12.2% and 8.5% respectively, and 0% for P2P units (Table 15).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors pointed out limitations such as the detection capability bottleneck, the lack of recipient traceability in tool channels, and limited corpus coverage, and future work could explore runtime relay and inference attacks.

   Limitations and future directions pointed out by the authors

   • Detection coverage is the dominant bottleneck: The authors point out in Section 7.1 that 95.5% of residual leakage stems from detection misses (especially concentrated in contextual attributes); the sanitizer cannot take measures on content that is not detected, and this limitation cannot be overcome by decision or transformation optimization alone; detection capability needs to be improved.
   • Recipient resolution in tool channels has boundaries: The authors point out in Section 7.1 that C3 tool parameters are directed at tools rather than agents, and 95.8% are self-loop events; extending this to recipient-aware protection requires a data provenance mechanism beyond the request-response pattern (tracking which agent consumed the tool output).
   • Graph reachability extension leads to over-sanitization: The authors point out in Section 6.4.4 that simply sanitizing based on static graph reachability leads to an 82% over-sanitization rate; future work needs to design more precise topology analysis mechanisms that incorporate observed forwarding behavior or actual propagation evidence.
   • Limitations of evaluation corpus and generalization scope: The authors point out in Section 7.2 that the experiments are based on an English four-domain subset of a single public benchmark, and the main configuration covers only a single generator and framework; cross-model and cross-framework tests cover only a few systems, and generalization to untested systems cannot be assumed.
   • Hidden-state leakage and advanced attacks not covered: The authors point out in Section 7.2 that leakage of hidden states in the model's internal reasoning was not detected or modeled; the threat model does not cover stronger improper collusion, cross-session inference, side channels beyond the 7 channels, or targeted reconstruction or adaptive attacks.
   • Heterogeneity of time-step distribution: The authors point out in Section 7.1 that 105 scenarios lack a common time step, with finance and medical mostly at T1 and legal mostly at T3 or longer; cross-domain comparisons are confounded by time-step length and cannot be regarded as domain estimates after controlling for time step.

   Experimental coverage

   • System coverage under test: The main generator model is Qwen3-32B, and model generalization tests cover 4 models in total: GPT-5-mini, Gemini-3.7-Flash, and Llama-3.3-70B; cross-framework tests cover 8 frameworks in total: AutoGen, CrewAI, Google ADK, LangChain, LangGraph, LlamaIndex, OpenAI Agents SDK, and Semantic Kernel.
   • Topology and scenario coverage: Covers 6 topology structures in total: CW-2, CW-7, P2P-4, P2P-7, P2P-10, and Hier-7, based on 485 multi-agent scenarios filtered from AgentLeak (enterprise 138, finance 100, medical 100, legal 147), with test time steps covering T1 to T20.
   • Channels and adversarial levels: Channel instrumentation covers 7 execution channels in total, C1 to C7; adversarial strength tests cover 3 levels in total: A0, A1, and A2.
   • Defense baselines and ablation settings: End-to-end defense comparison includes three baselines: no sanitization, AgentLeak one-size-fits-all masking, and Presidio; ablation tests cover static authorization policy, pure masking fallback, and exact-match backstop.
   • Unreported information: The paper does not report experiments in other (non-English) language environments, does not report task completion rates of real end users in actual interaction scenarios, and the reconstruction analysis is based on predefined heuristic rules rather than end-to-end adaptive red-team adversarial testing.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors state that multi-agent collaboration topologies change the boundary of information reachability, and the proposed RECONS sanitizer can preserve a high proportion of authorized disclosures while suppressing unauthorized leakage.

   1. Paper positioning: Targeting privacy leakage caused by collaboration in multi-agent systems, the paper studies how topology changes information propagation paths and proposes an adaptive sanitization mechanism based on recipient authorization.
   2. Core problem: In multi-agent systems, information legitimately disclosed to one agent often propagates through everyday collaboration to agents introduced by the topology that are unauthorized; traditional sensitivity-based one-size-fits-all defenses cannot distinguish authorization boundaries by recipient, leading to privacy violations or excessive utility destruction.
   3. Method highlights: The paper proposes the RECONS online sanitizer, which uses a three-stage "Detect-Decide-Transform" pipeline, performs layered detection on channels C1–C7 combining rules, NER, and an LLM judge, evaluates authorization at the communication boundary according to the recipient and contextual access control policy, and applies FPE encryption, mLDP perturbation, pseudonymization, or semantic rewriting to unauthorized propagation according to data type.
   4. Key experimental results:
      • In the topology evaluation over 485 scenarios, the surface leakage rate fluctuates only slightly across topologies, between 60.6% and 62.8%, while the leakage rate for agents newly introduced by the topology rises from 0% for CW-2 to 52.2% for Hier-7 under A2 (Figure 2 and 3).
      • The orchestration framework has an independent effect on leakage; with Qwen3-32B fixed, the policy-filtered leakage rates of the 8 frameworks show polarization, from 0.29% for Google ADK to 43.38% for AutoGen, a roughly 150-fold difference between extremes (Table 12).
      • In the defense evaluation over 405 held-out scenarios, RECONS reduces the residual leakage rate from 96.7% with no sanitization to 29.25%, while retaining 94.1% of authorized disclosures, whereas one-size-fits-all masking retains only 20.5% (Table 20).
      • Decomposition of residual leakage sources shows that 95.5% of residual leakage is attributed to detection misses, and field-level fallback lacking recipient identifiers accounts for 4.5% (Table 21).
      • Among 179,098 inference and cross-channel/agent aggregation instances, manually audited implicit reconstruction leakage was 0 (Table 9).
   5. Authors' conclusions and implications: The authors argue that privacy protection in multi-agent systems cannot rely on static assumptions about topology, model, or framework, but must be dynamically enforced at runtime for the actual recipients and communication paths that occur; topology determines the reach of information, and detection coverage is the core bottleneck constraining defense effectiveness.

   Collapse this answer

Related papers