mlsanityData to 14 Oct 2026

Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning

arXiv 2609.02967 ↗First posted 2 Sep 2026cs.CR cs.AI cs.LGcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Topology-guided safeguards for LLM-based multi-agent systems (MAS) train a GNN over the inter-agent communication graph to localize risky agents and intervene on the topology---but they assume one operator can pool all labeled traces. Across organizations that assumption breaks: episodes contain private prompts, tool outputs, and proprietary workflows, and no silo alone sees the full attack distribution. We cast privacy-preserving MAS safeguarding as graph federated learning and instantiate FGLGuard: each operator fits an edge-featured graph attention detector on its own judge-labeled episode graphs and shares only model updates. The method couples a proximal local objective for non-IID clients, domain-balanced aggregation, over-refusal-constrained threshold calibration, corroborated upstream scoring, and a guarded rewrite for blocked answers. Federation is not optional: off-the-shelf transfer collapses under distribution shift (AUROC 0.51 to 0.70 only after in-domain retraining), so a deployable guard must adapt on each site's private traces. On Agent-SafetyBench, R-Judge, and AgentDojo, federated FGLGuard exceeds the in-domain centralized ceiling on all three benchmarks without pooling any data---where unsupervised anomaly guards and local-only training fail. One guard federated across four different-domain operators comes within 0.03 AUROC of multi-domain centralization, while any single-domain guard collapses on the others. Live FGLGuard cuts AgentDojo's ground-truth attack-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 23 of its 41 references that are in the map. First posted on arXiv 2 Sep 2026.

Builds on

23 of 41 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks11 Aug
  2. 2025GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling25 May
  3. 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning26 Mar
  4. 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec
  5. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun
  6. 2024GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning13 Jun
  7. 2024R-Judge: Benchmarking Safety Risk Awareness for LLM Agents18 Jan

Other references · 16

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  2. 2017Graph Attention Networkscited by 8,923
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  4. 2018Federated Optimization in Heterogeneous Networkscited by 2,987
  5. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,988
  6. 2023Improving Factuality and Reasoning in Language Models through Multiagent Debatecited by 1,784
  7. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  8. 2023A Dynamic LLM-Powered Agent Network for Task-Oriented Agent Collaborationcited by 290
  9. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  10. 2022FedDC: Federated Learning with Non-IID Data via Local Drift Decoupling and Correctioncited by 181
  11. 2021Subgraph Federated Learning with Missing Neighbor Generationcited by 132
  12. 2022Federated Learning on Non-IID Graphs via Structural Knowledge Sharingcited by 88
4 more
  1. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systemscited by 32
  2. 2024Federated Graph Semantic and Structural Learningcited by 30
  3. 2024OpenFGL: A Comprehensive Benchmark for Federated Graph Learningcited by 16
  4. 2025SafeSieve: From Heuristics to Experience in Progressive Pruning for LLM-based Multi-Agent Communicationcited by 12

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation
  2. 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
  3. 2026WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference
  4. 2025G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems
  5. 2026Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems
  6. 2026ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
  7. 2024NetSafe: Exploring the Topological Safety of Multi-agent Networks
  8. 2026CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems