Selection-Invariant Communication Compilers for Privacy-Aware Multi-Agent LLM Workflows
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Structured multi-agent workflows exchange intermediate messages whose content and form can reveal private state even when the final output is safe. We identify selection-channel leakage: after authorization fixes what may be released, a private-state-aware choice among semantically valid realizations creates an additional inference channel. We introduce the selection-invariant communication compiler(SICC), which constrains this post-authorization representation kernel rather than prescribing templates. Any deterministic or independently public-randomized generator satisfying the invariant is valid; requirement-indexed canonical forms are one auditable implementation. We prove a compositional communication-layer guarantee: authorization, public-only form generation, and a dependency-safe utility gate make the emitted transcript reveal no information beyond the complete authorized view. Private-state-aware selection remains vulnerable after surface-disjoint and length-matched controls. Across 132 AgentLeak communication replays and 100 executable LangGraph tasks, deterministic SICC retains complete protocol utility without a positive excess-gain signal; independent public randomization preserves the same result in AgentLeak and 480 controlled cases.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 12 of its 23 references that are in the map. First posted on arXiv 4 Aug 2026.
Builds on
12 of 23 references.
Closest ancestors · 5
Same direction, newest first
- 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agents18 May
- 2026CalBench: Evaluating Coordination-Privacy Trade-offs in Multi-Agent LLMs10 May
- 2026Contextualized Privacy Defense for LLM Agents3 Mar
- 2025Defeating Prompt Injections by Design24 Mar
- 2025Protecting Users From Themselves: Safeguarding Contextual Privacy in Interactions with Conversational Agents22 Feb
Other references · 7
- 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 230
- 2018TarMAC: Targeted Multi-Agent Communicationcited by 208
- 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 171
- 2019Learning Efficient Multi-agent Communication: An Information Bottleneck Approachcited by 61
- 2024PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensemblescited by 57
- 2023Reducing Privacy Risks in Online Self-Disclosures with Language Modelscited by 47
- 2026PAC-BENCH: Evaluating Multi-Agent Collaboration under Privacy Constraintscited by 7
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
- 2026AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems
- 2026Verifier-Bound Communication for LLM Agents: Certified Bounds on Covert Signaling
- 2026When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
- 2026Information-Theoretic Privacy Control for Sequential Multi-Agent LLM Systems
- 2025AgentCrypt: Advancing Privacy and (Secure) Computation in AI Agent Collaboration
- 2026From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability
- 2026Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning