mlsanityData to 14 Oct 2026

ConVerse: Benchmarking Contextual Safety in Agent-to-Agent Conversations

arXiv 2511.05359 ↗First posted 7 Nov 2025cs.CR cs.CL cs.CYcited by 16

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

As language models evolve into autonomous agents that act and communicate on behalf of users, ensuring safety in multi-agent ecosystems becomes a central challenge. Interactions between personal assistants and external service providers expose a core tension between utility and protection: effective collaboration requires information sharing, yet every exchange creates new attack surfaces. We introduce ConVerse, a dynamic benchmark for evaluating privacy and security risks in agent-agent interactions. ConVerse spans three practical domains (travel, real estate, insurance) with 12 user personas and over 864 contextually grounded attacks (611 privacy, 253 security). Unlike prior single-agent settings, it models autonomous, multi-turn agent-to-agent conversations where malicious requests are embedded within plausible discourse. Privacy is tested through a three-tier taxonomy assessing abstraction quality, while security attacks target tool use and preference manipulation. Evaluating seven state-of-the-art models reveals persistent vulnerabilities; privacy attacks succeed in up to 88% of cases and security breaches in up to 60%, with stronger models leaking more. By unifying privacy and security within interactive multi-agent contexts, ConVerse reframes safety as an emergent property of communication.

Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 17 of its 35 references that are in the map. First posted on arXiv 7 Nov 2025.

Builds on

17 of 35 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025Terrarium: Revisiting the Blackboard for Multi-Agent Safety, Privacy, and Security Studies16 Oct
  2. 2025WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks22 Apr
  3. 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec
  4. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 13

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2020Extracting Training Data from Large Language Modelscited by 2,189
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  4. 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,395
  5. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  6. 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 230
  7. 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 171
  8. 2023Cooperation, Competition, and Maliciousness: LLM-Stakeholders Interactive Negotiationcited by 96
  9. 2024ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stagescited by 82
  10. 2024Operationalizing Contextual Integrity in Privacy-Conscious Assistantscited by 37
  11. 2025PrivaCI-Bench: Evaluating Privacy with Contextual Integrity and Legal Compliancecited by 37
  12. 2024CLEAR: Towards Contextual LLM-Empowered Privacy Policy Analysis and Risk Generation for Large Language Model Applicationscited by 33
1 more
  1. 2025Contextual Integrity in LLMs via Reasoning and Reinforcement Learningcited by 31

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 16.

16 papers.

Sort:

By area:

  1. 2026AI Agents May Always Fall for Prompt Injectionscited by 9
  2. 2026Information-Theoretic Privacy Control for Sequential Multi-Agent LLM Systemscited by 8
  3. 2026PAC-BENCH: Evaluating Multi-Agent Collaboration under Privacy Constraintscited by 7
  4. 2026MASEval: Extending Multi-Agent Evaluation from Models to Systemscited by 6
  5. 2026LiSA: Lifelong Safety Adaptation via Conservative Policy Inductioncited by 3
  6. 2026MuPPET: A Benchmark for Contextual Privacy of LLM Assistants in Multi-Party Conversationscited by 3
  7. 2026Opal: Private Memory for Personal AIcited by 1
  8. 2026SovereignNegotiation-Bench: Evaluating User-Owned Personal Agents In Delegated Bargaining Under Privacy, Consent, Evidence, And Institutional Pressurecited by 1
  9. 2026Silence Is Endorsement: Verification-Status Laundering in LLM Agent Pipelinescited by 1
  10. 2026REDDIT: Forgetting-Resistant Correction of Timestamp Drift in ASR via Replay-Based Distribution Editingcited by 0
  11. 2026From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systemscited by 0
  12. 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
4 more
  1. 2026Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Controlcited by 0
  2. 2026CoSec: Benchmarking Agent Security in Communitiescited by 0
  3. 2026Agent-Canary-Mas: End-to-End Evaluation of Protocol Risk in Long-Horizon Multi-Agent Systemscited by 0
  4. 2026RelLedger: Relational Information Governance for LLM Agent Organizationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Protecting Users From Themselves: Safeguarding Contextual Privacy in Interactions with Conversational Agents
  2. 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems
  3. 2026Loose Lips: Understanding Privacy Leakage in Agentic Dialogue
  4. 2026Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems
  5. 2026Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agents
  6. 2025The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration
  7. 2026When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network
  8. 2025Beyond Jailbreaking: Auditing Contextual Privacy in LLM Agents