Agent topology decides who sees the secret
Reviewing When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems · Sunday Oyinlola Ogundoyin and Muhammad Ikram
Researchers show that in multi-agent LLM systems, protected values reach unauthorised agents through routine forwarding, with no attack required. A recipient-aware sanitiser keeps authorised flows working far better than blanket redaction, but it is capped by detection: most of what still leaks was never recognised as sensitive in the first place.
Nobody in this study attacks anything. A user hands a value to an agent that is allowed to see it. That agent passes it along while coordinating with others, and the value lands with an agent that was never authorised. There is no prompt injection and no compromised model. It is just routine forwarding.
The researchers built hundreds of scenarios across three shapes of multi-agent system. In one, a coordinator hands work to workers. In another, peers talk directly. The third uses layered hierarchies. They watched seven places a value could surface, from the final answer to inter-agent messages, tool arguments, shared memory, logs and generated files.
The interesting result is what stayed the same. How often protected values leaked barely moved between topologies, sitting around six in ten. What changed was who received them. In a two-agent baseline, no extra recipient ever saw the value. In richer topologies, disclosure to agents introduced by the topology itself reached 52%. The leak rate was the same. There were simply more readers.
That is why sensitivity-based filtering misses the problem. A filter that asks "is this a secret?" gives the same answer whoever the recipient is. Either it strips the value from the agent that legitimately needs it, or it lets the value travel onwards. It cannot tell the difference because it never looks at the recipient.
Most of the leakage also happened away from the user. Tool calls, files, inter-agent messages and shared memory leaked more than final responses did. Auditing only what the user sees measures the quietest channel.
The fix is only as good as its detector
Their proposed defence is an inline sanitiser. It spots a protected value, works out who will receive it in this particular run, then decides whether to pass, redact or transform it. Credit where it is due: it cuts residual disclosure to roughly the level of blanket redaction. It also keeps nearly all authorised disclosures, against about a fifth for redact-everything. That is a real improvement in the trade-off.
The catch sits upstream. Of what still leaked, 95.5% was never detected, so the decision logic never got a chance to act. Contextual values, the kind that only matter given the surrounding conversation, were the hardest to spot and leaked most. I read that as a ceiling. Recipient-aware policy cannot protect what the detector does not recognise.
The threat model also assumes passive recipients. Nobody tested an agent or orchestrator deliberately probing for values, or an attacker phrasing secrets to slip past the detector. Framework choice alone swung leakage by a wide margin, so I would not expect these numbers to transfer neatly between stacks.
What surprised me is how little an attacker needs. Add an agent, or sit wherever inter-agent traffic flows, and wait. Nobody has to attack anything. The architecture does the forwarding.
Further analysis
Problem
The paper studies privacy leakage in multi-agent LLM systems (MALS) caused not by a single inappropriate disclosure but by routine forwarding and coordination that can move an authorised value to an unauthorised recipient. Conventional sensitivity-based defences either over-sanitise authorised flows or under-protect propagated disclosures because they ignore the realised communication recipient and path. The authors frame this as topology-conditioned recipient exposure: the communication graph and runtime orchestration determine which recipients become reachable and therefore which authorisations matter.
Approach
The authors evaluate 485 scenarios derived from a public benchmark across six topology cells (coordinator–worker, peer-to-peer and hierarchical variants) and three adversary levels, instrumenting seven observable channels (final output, inter-agent messages, tool inputs/outputs, shared memory reads/writes, logs, and artifacts). They run 8,730 execution records producing 122,220 channel-level instances under a fixed detector pipeline that combines deterministic matching and an LLM judge. They measure surface leakage, disclosure to topology-introduced recipients, and unauthorised propagation, replicate key sweeps across multiple generator models and orchestration frameworks, and introduce RECONS, a Detect→Decide→Transform inline sanitizer that conditions transformation on the resolved recipient and execution context rather than sensitivity alone.
Key Findings
- Topology reshapes reach rather than overall disclosure incidence: surface leakage stays nearly flat (60.6–62.8%) while disclosure to topology-introduced recipients rises from 0% (two-agent baseline) up to 52.2% in richer topologies.
- Framework and model choices substantially modulate exposure: holding topology fixed, framework choice produced up to roughly 150× spread in policy-filtered leakage, and different generator models yielded markedly different magnitudes and cell orderings.
- RECONS substantially improves the privacy–authorization trade-off: it reduces residual disclosure from 96.7% without sanitization to 29.25%, close to blanket redaction (28.3%), while preserving 94.1% of authorised disclosures versus 20.5% under blanket redaction.
- Detection coverage is the dominant bottleneck: 95.5% of RECONS’s residual disclosures are undetected values that never reached its decision layer; contextual values show the highest residual leakage (55.7%) and the poorest detection recall (36.0%).
- Leakage concentrates in non-user-facing channels: tool arguments and outputs, artifacts, inter-agent messaging and shared memory exhibit higher rates than final user-facing outputs, so auditing only final responses underestimates exposure.
Limitations
Results are bounded by the benchmark corpus, the seven instrumented channels, the chosen detectors and pinned judge, and the evaluated frameworks and generators. The threat model assumes observable channels and passive recipients; it excludes stronger collusion, cross-session inference, latent internal state leakage and uninstrumented side channels. RECONS’s effectiveness is limited by detection recall and by channels lacking resolvable recipients, and some transformation verification depends on the same judge used for detection.
Implications
From an offensive perspective, an attacker need not compromise models or inject malicious prompts to obtain protected values: adding agents or leveraging benign coordination can expose authorised content to unauthorised parties via routine forwarding. Internal observers or compromised orchestrators that monitor inter-agent messages, tool-call arguments or shared memory can harvest propagated secrets. The dominant practical attack surface is direct disclosure followed by propagation, amplified by weak detectors for contextual content; improving detection coverage or targeting inter-agent channels offers the most effective route to increase successful unauthorised recovery.
The paper title, authors and abstract
When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to one authorized agent can propagate through routine coordination to an unauthorized one, without compromise or malicious behavior. This motivates topology-aware enforcement that blocks unauthorized propagation while preserving authorized disclosure. We evaluate 485 scenarios across coordinator-worker, peer-to-peer, and hierarchical topologies, instrumenting seven communication channels and measuring surface leakage and disclosure to topology-introduced recipients. We introduce RECONS, a Detect -> Decide -> Transform sanitizer conditioning intervention on recipient and execution context rather than sensitivity alone. Topology changes where protected information propagates, with disclosure to topology-introduced recipients rising from 0% to 52.2% while surface leakage stays nearly flat at 60.6-62.8%. This effect persists across four generator models and a second orchestration framework, though magnitude and relay paths differ; framework choice separately drives a 150x leakage spread, so topology alone is not sufficient. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction. Detection coverage is the dominant bottleneck, accounting for 95.5% of residual disclosures. These results show that privacy enforcement in MALS must reason about the recipient and communication path realized at runtime, not sensitivity or topology assumptions alone.
