mlsanityData to 14 Oct 2026

Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs

arXiv 2608.29028 ↗First posted 29 Aug 2026cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call summary collapse. On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge (kappa = 0.74), where σb = 1 means every boundary marker survives verbatim and σb = 0 means all are lost. Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson r near zero): uncompressed free-text handoffs preserve boundaries at σb ≈ 0.80, whereas a 25-word budget drops σb to ≈0.57 while operational-fact survival stays near ceiling. Controlled downstream tests reveal that protection depends on boundary explicitness: vague languages leak in 73% of GPT and 50% of DeepSeek cases, while explicit constraints reduce leakage to under 15% across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 19 of its 42 references that are in the map. First posted on arXiv 29 Aug 2026.

Builds on

19 of 42 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026State Contamination in Memory-Augmented LLM Agents16 May
  2. 2026AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems12 Feb
  3. 2025Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution1 Jun
  4. 2025AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents12 Mar
  5. 2025Red-Teaming LLM Multi-Agent Systems via Communication Attacks20 Feb
  6. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  7. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep

Other references · 12

  1. 2025Qwen3 Technical Reportcited by 8,820
  2. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,988
  3. 2025A-MEM: Agentic Memory for LLM Agentscited by 1,063
  4. 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 230
  5. 2024TradingAgents: Multi-Agents LLM Financial Trading Frameworkcited by 188
  6. 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 171
  7. 2025REALM-Bench: A Benchmark for Evaluating Multi-Agent Systems on Real-world, Dynamic Planning and Scheduling Taskscited by 16
  8. 2025MoMoE: Mixture of Moderation Experts Framework for AI-Assisted Online Governancecited by 13
  9. 2025Self-Organizing Agent Network for LLM-based Workflow Automationcited by 12
  10. 2026PAIR-SAFE: A Paired-Agent Approach for Runtime Auditing and Refining AI-Mediated Mental Health Supportcited by 7
  11. 2026Hippocampus: An Efficient and Scalable Memory Module for Agentic AIcited by 3
  12. 2026From Plausible to Causal: Counterfactual Semantics for Policy Evaluation in Simulated Online Communitiescited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Attention Tax, Handoff Tax: A Stylised Model of When Multi-Agent LLM Systems Help
  2. 2026When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary
  3. 2026Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents
  4. 2025Agent Tools Orchestration Leaks More: Dataset, Benchmark, and Mitigation
  5. 2026When "Must" Becomes "Maybe": Constraint Weakening in LLM Agent Workflows
  6. 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems
  7. 2026How Much Coordination Gain Is Real? A Paired Noise-Floor Protocol for Multi-Agent LLM Benchmarks
  8. 2026OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents