Privacy-Enhancing Paradigms within Federated Multi-Agent Systems

• Federated MAS focuses on real-time collaboration and communication, unlike FL’s global model training and exchange of model updates.Federated MAS must safeguard privacy dynamically during task execution and conversations.Source: §1 · pp. 1–2
• The identified challenges are heterogeneous agent privacy requirements, variable conversational structure, and dynamic network topology.Prior approaches may not extract task-relevant information from memory banks or adapt to agent heterogeneity.Source: §1 · p. 2
• Existing privacy methods can impose stringent protections and high computational complexity, complicating the balance between privacy and system utility.The introduction poses the design goal as meeting agents’ privacy needs while maintaining stable performance and avoiding excessive complexity.Source: §1 · p. 2
• EPEAgents embeds a privacy-enhanced agent in RAG and context retrieval, using agent self-descriptions to plan task-relevant, agent-specific messages.Agents receive filtered information rather than raw data in their message streams.Source: §1 · p. 2
• Privacy protection effectiveness reaches up to 97.62%, with minimal impact on system performance.The introduction describes EPEAgents as adapting to dynamically changing network topologies.Source: §1 · p. 3
• The evaluation dataset includes financial and medical data, multiple-choice questions, and open-ended contextual tasks for assessing performance and privacy.The experiments used 25 synthetic profiles designed to reflect real-world distributions.Source: §1 · pp. 2–3

2.1 Federated Learning

• Federated learning has been applied across computer vision, graph learning, and NLP, including machine translation, speech recognition, and MAS.Privacy-focused MAS studies remain relatively scarce, and many existing approaches do not meet all three challenges identified in the introduction.Source: §2.1 · p. 3

2.2 Privacy within MAS

• MAS privacy approaches include attacker exclusion, agent decomposition with homomorphic encryption, differential privacy, and context partitioning, but often suit only specific scenarios.Differential-privacy protection can be difficult to control, while computationally complex algorithms may be unsuitable for MAS.Source: §2.2 · p. 3

• A MAS contains N agents, and each operational round has a subset of communicating agents, including a designated privacy-enhanced agent.The server agent’s memory aggregates the agents’ memories at the start of the interaction round.Source: §3 · p. 3
• MAS communication uses directed spatial and temporal edges; spatial edges can include task content and agent self-descriptions, while temporal edges typically carry task-related content.The spatial and temporal graph structures represent agent interactions across the system’s rounds.Source: §3 · p. 3
• In the conventional pipeline, agents retrieve task-relevant information and store interactions in a server memory bank, creating privacy-leakage risks.Figure 2 contrasts an unscreened flow with one filtered through EPEAgents.Source: §3 · p. 4, Figure 2 · p. 4
• The evaluation defines user profiles with 11 fields and distinguishes performance questions from privacy questions, which include the responsible-agent label.The section also defines correct MAS answers by whether the final answer matches the predefined correct option.Source: §3 · p. 4

4.1 Overview

• EPEAgents acts as a server-side intermediary in RAG and memory retrieval, routing task-relevant, agent-specific messages and restricting later exchanges to CA-filtered information.Local agents first send self-descriptions to CA, which uses them and user profiles to prepare the initial messages.Source: §4.1 · pp. 4–5

4.2 Privacy Enhanced Agent Design

• CA matches profile entries to agent roles, supports user-confirmed permission upgrades when needed, and filters intermediate reasoning to limit unauthorized disclosure.The paper focuses on user profiles; it notes that database retrieval, such as from hospital records, could extend the matching step.Source: §4.2 · p. 5

4.3 MAS Architecture Design

• The evaluation uses a 3+n architecture, with three local agents and n CA, for the financial and medical scenarios.The described local-agent roles cover market data, risk assessment, and transaction execution in finance, and diagnosis, treatment recommendation, and medication management in medicine.Source: §4.3 · pp. 5–6

4.4 Synthetic Data Design

• The synthetic dataset covers user profiles and MCQ/OEQ across finance and medicine, with questions drafted by GPT-o1, reviewed by multiple models, and manually verified.Privacy questions use profile labels to designate responders; MCQs include a refusal option, while OEQ prompts instruct agents to refuse unauthorized requests.Source: §4.4 · pp. 6–7

4.5 Discussion

• The server-side privacy model uses existing large models, while LLM-generated profile labels may not reflect users’ subjective preferences, motivating practical alignment benchmarks.The discussion identifies exploration of lighter, specialized models as future work.Source: §4.5 · p. 7

5 Experiment

• Experiments covered 21,750 samples across five models and two domains, including financial and medical scenarios.The evaluation included utility and privacy effects for baseline methods and EPEAgents.Source: §5 · pp. 7–8, Table 1 · p. 8

5.1 Experimental Setup

• The evaluation dataset included user profiles, multiple-choice questions, and open-ended contextual questions for financial and medical scenarios.The test sample combines an entry, field, question type, stem, and answer.Source: §5.1 · p. 8
• Utility was assessed primarily with MCQs because open-ended answers are difficult to standardize and evaluate consistently.Privacy evaluation used both MCQs, with a “Refuse to answer” option, and OEQs guided by explicit response instructions.Source: §5.1 · p. 8

5.2 Experiment Results

• Privacy scores improved significantly across scenarios, while utility rose slightly in most cases and sometimes declined with weaker backbones.Table 1 compares baseline and EPEAgents across financial and medical settings; utility is measured on MCQ and privacy on MCQ and OEQ.Source: §5.2 · pp. 8–9, Table 1 · p. 8

5.3 Ablation analysis.

• Claude-3.5’s Privacy score increased 71.96%, compared with 44.01% for Gemini-1.5 under EPEAgents.Without EPEAgents, GPT-o1’s financial-scenario Privacy score was 15.89, just 3.51% above GPT-3.5-turbo’s.Source: §5.3 · p. 9
• 6.29% was Gemini-1.5’s peak Privacy-score improvement as CA count varied; with Claude-3.5, Privacy tended to decrease as n increased.Increasing n slightly improved Privacy for lower-performing CA backbones, but the improvement was less significant for higher-performing backbones.Source: §5.3 · p. 9, Figure 5 · p. 9
• 58.67% was the Privacy score when Gemini-1.5 served as the CA backbone with GPT-o1 local agents, 38.95% below the original score.A strong CA backbone achieved substantial Privacy scores even when local agents used less capable models.Source: §5.3 · p. 9, Figure 6 · p. 9

6 Conclusion

• EPEAgents minimizes data flow by sharing only task-relevant, agent-specific information through the RAG and context retrieval stages.Source: §6 · p. 9
• Federated MAS faces heterogeneous privacy protocols, structural complexity in multi-party conversations, and dynamic conversational network structures.Source: §6 · p. 9
• The paper emphasizes dynamic privacy-enhancing techniques for MAS, particularly in high-stakes domains where privacy and security are essential.Source: §6 · p. 10