Concealing multi-agent communication networks by adding fake connections
Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection
Cryptography and SecurityArtificial Intelligence
Summary
LLM-based multi-agent systems rely on how their agents communicate, but this communication pattern can reveal secret system designs even when hidden. The authors introduce MIRAGE, a method that hides the real communication links by creating fake ones that look believable in the agents' message exchanges. Their approach keeps the system working well while making it hard for outsiders to guess the true design. Experiments show MIRAGE effectively protects the system’s structure without harming performance.
What this means in practice
- •For development teams building multi-agent systems: Protect the design of multi-agent communication networks from reverse engineering while maintaining task effectiveness.
- •For cybersecurity engineers: Secure AI-driven collaborations by obscuring communication patterns that can reveal system vulnerabilities or proprietary structures.
Authors
Longzhu He, Zelang Wen, Xinfeng Li, Sen Su, XiaoFeng Wang
Abstract
Driven by the rapid advancement of large language models (LLMs), LLM-based multi-agent systems (MAS) have emerged as a powerful paradigm for collaborative reasoning over complex tasks. A key design element of MAS is the communication topology, which governs information flow among agents and often encodes proprietary knowledge about the system architecture. However, recent work has shown that such topologies can be inferred even in black-box settings by exploiting semantic dependencies in observable reasoning traces, posing significant risks of intellectual property leakage and exposure of system vulnerabilities. To address this threat, we propose MIRAGE, a topology-concealment framework that preserves the genuine communication topology for task execution while shaping adversary-facing semantic evidence toward a carefully constructed phantom topology. Specifically, MIRAGE operates in three stages: (1) phantom topology synthesis, (2) semantic edge realization, and (3) protected MAS execution. It constructs a phantom topology structurally distinct from the genuine one, materializes phantom edges as plausible semantic dependencies, and suppresses source-specific cues that could reveal genuine edges absent from the phantom topology. Extensive experiments across three topology optimization frameworks and four benchmark datasets demonstrate that MIRAGE substantially reduces the effectiveness of topology inference attacks while largely preserving the task utility of the protected MAS.