Summary
When multiple AI agents talk to each other, secrets given to one agent can accidentally spread to others not supposed to know. The authors found that traditional methods protecting secret information often miss these leaks because they only look at how sensitive the information is, not who receives it or how agents are connected. They studied many communication setups and made a new system called RECONS that watches who will get the information and changes it to block leaks while still letting authorized sharing happen. This shows that protecting privacy in multi-agent AI needs to understand not just the data, but the whole network of who talks to whom.
What this means in practice
- •For enterprise ai developers: Prevent confidential data leaks in multi-agent AI workflows by controlling information flow based on communication topology and recipient identity.
- •For cloud security teams: Enhance security policies for AI orchestration platforms to detect and reduce unauthorized information sharing between cooperating AI agents.
Abstract
Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to one authorized agent can propagate through routine coordination to an unauthorized one, without compromise or malicious behavior. This motivates topology-aware enforcement that blocks unauthorized propagation while preserving authorized disclosure. We evaluate 485 scenarios across coordinator-worker, peer-to-peer, and hierarchical topologies, instrumenting seven communication channels and measuring surface leakage and disclosure to topology-introduced recipients. We introduce RECONS, a Detect -> Decide -> Transform sanitizer conditioning intervention on recipient and execution context rather than sensitivity alone. Topology changes where protected information propagates, with disclosure to topology-introduced recipients rising from 0% to 52.2% while surface leakage stays nearly flat at 60.6-62.8%. This effect persists across four generator models and a second orchestration framework, though magnitude and relay paths differ; framework choice separately drives a 150x leakage spread, so topology alone is not sufficient. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction. Detection coverage is the dominant bottleneck, accounting for 95.5% of residual disclosures. These results show that privacy enforcement in MALS must reason about the recipient and communication path realized at runtime, not sensitivity or topology assumptions alone.