PaperlayerView exact revision on arXiv

Source-linked AI summary

Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs

Yian Wang, Agam Goyal, Eshwar Chandrasekharan, Hari Sundaram

arXiv:2608.29028v1cs.AI

TL;DR

Multi-agent handoffs can preserve operational facts while losing the boundary metadata that limits their use, creating summary collapse and privacy leakage. The paper tests this failure with controlled handoff and downstream experiments, finding that explicit, correctly operationalized audience boundaries provide the strongest protection. The study is limited by its semi-synthetic scenarios and simulated audiences, motivating validation on production traces and with users.

  • Problem

    The paper addresses limited evidence about privacy leakage at the inter-agent handoff artifact, where compressed summaries may preserve facts while losing the rules governing their disclosure.

  • Method

    The paper constructs BOUND-HANDOFF and combines survival measurements, matched marker-strength tests, enforcement comparisons, and human-validated leakage evaluation.

  • Results

    A gold-derived typed audience-allowlist reduces leakage to 0/48 on both primary models, whereas corrupted boundary fields restore leakage to 44/48.

  • Takeaways & Limitations

    Boundary information should reach downstream agents as correct, typed, machine-actionable audience constraints rather than relying on natural-language salience alone.

  • Takeaways & Limitations

    The scenarios and audiences are simulated, and genuine multi-agent production traces and user studies of perceived harm remain needed.

Abstract

from arXiv · show

Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \emph{summary collapse}. On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge ($κ= 0.74$), where $σ_b = 1$ means every boundary marker survives verbatim and $σ_b = 0$ means all are lost. Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson $r$ near zero): uncompressed free-text handoffs preserve boundaries at $σ_b \approx 0.80$, whereas a $25$-word budget drops $σ_b$ to ${\approx}0.57$ while operational-fact survival stays near ceiling. Controlled downstream tests reveal that protection depends on \emph{boundary explicitness}: vague languages leak in $73\%$ of GPT and $50\%$ of DeepSeek cases, while explicit constraints reduce leakage to under $15\%$ across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.

1 Introduction

Multi-agent handoffs can preserve the operational facts needed for action while dropping the boundary markers that restrict their use, creating summary collapse and privacy leakage. The paper studies this handoff artifact and motivates typed, explicit boundary constraints as the relevant design target.

  • Research gap: Existing privacy benchmarks largely assess single-agent norm decisions or extraction, whereas this paper analyzes the artifact produced between agents.
  • Summary collapse: Compressed handoffs preserve operational facts while weakening or omitting the boundary markers that govern their use.Once a limiting phrase disappears, the downstream agent treats the fact as ordinary information.
  • Summary collapse: Summary collapse produces leakage when a downstream audience receives content licensed only for a narrower audience.
  • Boundary explicitness: Marker strength varies from vague hedges that leak in 73%/50%/38% of cases to explicit constraints that reduce leakage below 15%.
  • Mitigation: A gold-derived typed audience-allowlist suppresses leakage to 0/48 on both primary models, while a corrupted allowlist restores leakage to 44/48.

2 Related Work

Prior work studies privacy decisions, extraction, and communication-channel attacks, while this paper shifts analysis to the handoff artifact that carries information between agents. It connects this artifact to Communication Privacy Management while operationalizing, rather than fully formalizing, that theory.

  • Privacy and contextual norms: Prior privacy work evaluates contextual disclosure decisions by individual agents, whereas this paper examines the handoff artifact created when one agent compresses interaction for another.
  • Multi-agent privacy leakage: Related multi-agent studies examine internal-channel violations, compositional leakage, prompt injection, environmental manipulation, or extraction from persistent state.
  • Communication Privacy Management: Communication Privacy Management models privacy as boundary work involving ownership, audience licensing, use conditions, and boundary turbulence.
  • Communication Privacy Management: The paper operationalizes CPM dimensions through four marker categories rather than formalizing CPM’s full rule-management theory.

3 Method

The method isolates how handoff artifacts preserve or lose boundary metadata by testing controlled scenarios, handoff conditions, surfaces, and survival measures. It separates artifact-level context dumps from audience-facing final leakage.

  • Testbed: BOUND-HANDOFF isolates boundary-metadata changes when upstream interactions become downstream-consumed handoff artifacts.Scenarios specify operational facts, boundary rules, and textual markers expressing those rules.
  • Leakage outcomes: A context dump is sensitive content in the handoff or internal context, whereas final leakage is disclosure in the downstream audience-facing output.Context dump is an artifact property; final leakage is the externally observable harm.
  • Operational measures: The notation defines σ = 1.0 as verbatim survival of every marker and σ = 0 as complete marker loss.
  • Testbed: BOUND-HANDOFF contains 36 scenarios across seven coordination domains, with five handoff conditions and four handoff surfaces.
  • Operational measures: Boundary-marker survival σb and operational-fact survival σop score what survives, while compression ratio ρ measures token-level compression pressure.σb and σop use four-level survival judgments; ρ = 1−|h|/|u|.

4 Experimental Setup

The experiments combine stratified handoff-survival measurements with matched downstream tests of marker strength and enforcement strategies across three model families. Human-validated judging and calibrated detectors support separate analyses of boundary survival and leakage.

  • Research questions: The study tests whether compression selectively reduces σb, whether marker strength controls leakage, and whether typed boundaries outperform other enforcement strategies.
  • Experiment mapping: E1–E2 measure survival under compression, E3–E5 and E8 test marker effects, and E6–E7 and E9 compare enforcement strategies.
  • Controls: Controls include a fixed-snapshot baseline, noisy-allowlist errors, three-hop memory comparisons, and role-label manipulation.
  • Models: GPT-5-mini and DeepSeek-R1-32B are tested throughout, while Qwen3-32B provides targeted cross-pipeline replication.
  • Evaluation: Boundary and operational-fact survival use a human-validated judge with κ = 0.74, while leakage uses exact detectors and a calibrated semantic judge.The semantic judge is calibrated before evaluation on later experiment outputs.

5 Results

The results show that compression selectively strips boundary metadata while preserving operational facts, and that downstream protection depends on explicit, operationalized boundary constraints. Prompt-only instructions and exact-string redaction remain incomplete, whereas correctly typed audience allowlists substantially suppress leakage.

  • RQ1: Boundary Survival Decouples from Operational Survival: Pearson r = −0.042 on GPT-5-mini and 0.086 on DeepSeek-R1-32B show that boundary-marker survival σb and operational-fact survival σop are nearly uncorrelated across 180 handoffs per model.Seven GPT-5-mini and 26 DeepSeek-R1-32B handoffs simultaneously had σb < 0.7 and σop > 0.9.
  • RQ1: Boundary Survival Decouples from Operational Survival: Under hard compression, boundary-marker survival falls sharply while operational-fact survival remains near ceiling, indicating selective metadata loss rather than uniform information degradation.The same baseline-to-compression pattern is reproduced by Qwen3-32B.
  • RQ1: Boundary Survival Decouples from Operational Survival: Between 25% and 39% of boundary markers are scored absent under 25-word compression, while operational facts remain at 92% or higher preserved with zero absent.The ordinal result shows complete marker drops, not merely weakening or paraphrase.
  • RQ1: Boundary Survival Decouples from Operational Survival: Under matched 25-word compression, the flagship model has σb = 0.526 [0.408, 0.640] versus σop = 0.983 [0.962, 1.000], reproducing the selective pattern.This result extends the pattern beyond small or distilled models.
  • RQ1: Boundary Survival Decouples from Operational Survival: Changing a marker’s role label moved σb by between −0.069 and +0.072 while σop stayed near ceiling, so prompt-level salience was unreliable and model-dependent.A stronger compression-priority instruction helped Qwen3-32B by ≈0.13 but did not reliably help DeepSeek-R1-32B and imposed a small σop cost.
  • RQ2: Marker Strength Controls Downstream Leakage: Explicit boundary constraints sharply reduce leakage: vague “use discretion” markers leak 44/48 GPT and 38/48 DeepSeek cases, nearly matching no-marker conditions.The matched tests hold operational content constant while varying the boundary treatment.
  • RQ2: Marker Strength Controls Downstream Leakage: The marker-strength gradient is sharply non-linear: vague hedges leak 35/48 GPT and 24/48 DeepSeek cases, while soft suggestions leak 6/48 and 5/48.Explicit constraints and hard imperatives are nearly equivalent, with the essential transition occurring from L1 to L2.
  • RQ2: Marker Strength Controls Downstream Leakage: The no-handoff control leaks 20/48 GPT and 11/48 DeepSeek cases with direct full-marker access, exceeding the operationalized dump_with_marker handoff’s 2/48 GPT leakage.The comparison identifies boundary representation as the key factor rather than multi-agent topology.

6 Discussion and Implications

The discussion reframes privacy risk from downstream decision-making to the handoff artifact that encodes what downstream agents may do. It therefore recommends machine-actionable boundary fields, robust validation, confidence scoring, and abstention for uncertain extraction.

  • Implications: A downstream agent may disclose a fact correctly relative to a handoff state that no longer encodes its governing boundary.The paper consequently treats boundary extraction as the engineering problem and recommends typed audience scope and provenance fields.
  • Implications: Three-hop results show that audience-facing leakage can understate governance loss when later hops drop protected content together with its rule.This makes final-output leakage insufficient as the sole evaluation measure.
  • Implications: Boundary information should reach downstream agents as typed, machine-actionable constraints rather than prose requiring interpretation.The proposed pipeline includes paraphrase-robust validators, confidence scoring, and abstention for low-confidence boundary fields.

7 Conclusion

The paper identifies summary collapse as a structural privacy failure in multi-agent coordination: compression preserves operational facts while stripping boundary metadata. It finds that correctly identifying and representing audience boundaries is central to protection, while automated typed-boundary extraction remains open.

  • Summary collapse preserves operational facts while stripping the boundary metadata that licenses their use.
  • A gold-derived typed audience-allowlist schema reduces leakage to 0/48 on both primary models.Protection depends on allowlist correctness and machine-readability, not schema use alone.
  • Leakage protection degrades smoothly as the audience allowlist becomes less accurate.
  • Automated typed-boundary extraction and validation remain open problems, with production-trace and multilingual validation also outstanding.Suggested safeguards include paraphrase-robust validators, confidence scoring, and abstention when boundaries cannot be extracted reliably.

Limitations

The evaluation uses hand-authored synthetic scenarios and simulated LLM audiences, so measured leakage reflects model behavior rather than human stakeholders. External PrivacyLens traces reproduce the failure more sharply, but genuine production traces and user studies remain necessary for deployment-level claims.

  • The scenarios are hand-authored and downstream audiences are LLMs, so measured leakage is mediated by model behavior rather than human stakeholders.
  • On 493 externally authored PrivacyLens traces, σ_b falls to 0.28 under compression and 41% of handoffs enter the low-σ_b / high-σ_op quadrant.This compares with 4–14% in the paper’s own scenarios.
  • The external traces remain semi-synthetic and single-agent, and audiences remain simulated throughout.
  • Genuine multi-agent production traces and user studies of perceived harm are needed before deployment-level claims.

Ethics Statement

The ethics statement uses synthetic, non-personal scenarios and frames privacy boundaries normatively while limiting claims to the testbed’s mechanistic evidence. It also considers dual-use risks and reports that the work’s intended effect is constructive mitigation.

  • Use of data: All testbed scenarios are hand-authored synthetic vignettes containing no real user data, personally identifying information, or scraped private communications.Sensitive facts are illustrative content written to instantiate plausible Communication Privacy Management categories.
  • Dual-use considerations: The paper judges disclosure’s net effect positive because summary collapse is structural, already implicitly exploited by context-dump handoffs, and accompanied by a constructive fix.
  • Broader impact: The framing is normative, but the paper makes only a mechanistic claim for multi-agent systems: handoffs preserve some propositions and weaken others.
  • Broader impact: Deployment-level claims about harm to specific user populations require field studies that the testbed does not provide.

AI Involvement Disclosure

The paper used AI assistants for writing support בלבד, while authors retained responsibility for research design, experiments, annotation, analysis, and final wording. The disclosure also describes the benchmark, handoff conditions, models, and evaluation specification.

  • AI assistance: AI assistants supported drafting, prose revision, phrasing, grammar, and consistency checks, but not research ideas, results, citations, or annotation.
  • Author responsibilities: The authors performed research design, scenario authoring, experiment execution, manual annotation, statistical analysis, and final wording decisions.
  • Benchmark specification: The benchmark defines markers as anchored to operational or sensitive facts so marker survival can be checked deterministically at handoff.
  • Handoff surfaces: The testbed covers four handoff surfaces, including explicit summaries, forwarding to a summarizer, memory replay, and report writing.
  • Handoff conditions: Handoff conditions range from free-text summarization and hard word budgets to marker-preserving instructions, sectioned templates, and typed schemas.
  • Models and compute: Experiments use GPT-5-mini, DeepSeek-R1-32B, and Qwen3-32B through the OpenAI API or a campus inference endpoint.

B.2 Experiment Families

The paper organizes its evaluation into experiments testing handoff survival, compression, marker explicitness, single-agent controls, mitigation, and typed audience allowlists. Across these families, operational facts remain near ceiling while boundary survival varies, and explicit markers and gold-derived allowlists substantially reduce leakage.

  • Baseline and compression: E1 measures boundary-marker survival (σb), operational-fact survival (σop), and task success on a stratified handoff subset.The full design space contains 720 cells, while E1 samples a deterministic 180-prompt subset.
  • Baseline and compression: 40-word and 25-word hard-budget conditions test whether selective boundary fragility widens as compression increases.These conditions are introduced in E2 as one-sentence handoffs under fixed word budgets.
  • Marker and topology controls: Matched context-dump variants hold operational content constant, isolating the effect of boundary-marker presence on downstream leakage.E3 crosses no marker, marker, and no-dump variants with four downstream pressure conditions.
  • Marker and topology controls: Weak-marker tests evaluate whether vague language such as “use discretion” functions like an operational boundary rule.E4 adds a weak-marker variant to the controlled context-dump design.
  • Marker and topology controls: A no-handoff single-agent control tests whether direct transcript access with natural-language markers is sufficient for privacy protection.The control includes direct_full_marker, direct_weak_marker, and direct_no_marker conditions.
  • Mitigation and explicitness: Prompt-only mitigation, enforced redaction, marker-strength gradients, and gold-derived typed audience allowlists form the RQ3 intervention tests.The marker gradient spans no marker, generic caution, disclosure-specific suggestion, explicit constraint, and hard imperative; the allowlist attaches allowed_audiences to each fact.
  • Mitigation and explicitness: E9 tests whether solving boundary extraction through annotation changes downstream behavior by supplying an explicit allowed_audiences field.This experiment operationalizes the boundary as an access-control-like schema.
  • Metric scoring: The judge assigns preserved, paraphrased, weakened, or absent labels to boundary markers and operational facts using scores of 1.0, 0.75, 0.35, and 0.0.σop is computed analogously to σb with the same rubric, so score differences reflect proposition type rather than scale.

C.4 σb Weighting Robustness

Across robustness checks, boundary-marker survival remains selectively fragile while operational-fact survival stays comparatively high. The pattern persists across weighting schemes, pressures, models, and downstream evaluations, while typed boundaries provide the strongest protection.

  • Measurement: σb < 0.7 and σop > 0.9 are descriptive cutoffs indicating weakened marker survival alongside preserved operational facts.The thresholds are visualization conventions, not analytic criteria.
  • Weighting robustness: The marker–operational decoupling persists under alternative σb weightings, including binary-strict and binary-lenient schemes.The result does not depend on assigning a particular value to the weakened-marker category.
  • Statistical robustness: Under 25-word compression, marker-versus-operational contrasts are significant on GPT-5-mini, DeepSeek-R1-32B, and Qwen3-32B.Mantel–Haenszel common odds ratios are 3.92, 4.36, and 4.33, respectively.
  • Leakage measurement: 44/48 GPT and 38/48 DeepSeek outputs were manually confirmed as leaks, exceeding heuristic counts of 37/48 and 26/48.The audit indicates that the calibrated heuristic undercounts paraphrase-style leakage.
  • No-handoff control: 20/48 GPT and 11/48 DeepSeek direct-full-marker cases leaked, versus 2/48 and 1/48 for operationalized dump_with_marker handoffs.The no-handoff control shows that direct access to full markers is not sufficient for reliable protection.
  • Mitigation checks: Exact-phrase leakage fell to 0/288 on the two primary models while task success remained 0.998 for GPT and 0.997 for DeepSeek.Residual semantic leakage remains after phrase-level redaction, including indirect references to sensitive categories.

E External Validity on Independently Constructed Traces

Evaluation on 493 independently authored PrivacyLens scenarios reproduces the boundary–fact decoupling on external traces. However, the traces remain semi-synthetic and single-agent, and their operational-fact measurement is weaker than on BOUND-HANDOFF.

  • External-trace adaptation: 493 PrivacyLens scenarios were converted using gold sensitive items, contextual-integrity norms, recorded tool-call trajectories, and gold boundary markers.The adaptation compresses actual agent traces without requiring a fresh annotation pass.
  • External-trace results: σb fell from 0.73 under structured schema to 0.28 under compressed free text, while σop stayed within 0.94–0.99 across every condition.The extreme conditions had non-overlapping 95% intervals.
  • Decoupling: Pearson r = 0.04 between marker and operational-fact survival, with 1,004 of 2,465 handoffs (41%) in the low-σb/high-σop quadrant.The corresponding quadrant rate on BOUND-HANDOFF was 4–14%.
  • Cross-testbed comparison: Free-text handoffs preserved boundaries at σb = 0.47 on PrivacyLens versus approximately 0.80 on the authors’ scenarios.Externally authored traces therefore lost boundary metadata faster than the hand-authored testbed traces.
  • Scope: PrivacyLens remains semi-synthetic and single-agent, while real multi-agent production traces with ground-truth boundary labels remain unavailable.Its operational facts derive from user instructions rather than gold annotation, making σop weaker and potentially optimistic.
  • Scope: A single norm per PrivacyLens datapoint prevents conclusions about how frequently boundary markers appear in real relays.The externally authored traces validate survival behavior but do not establish real-world marker prevalence.
Loading 2608.29028v1…