Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning

1 Introduction

• The communication graph is both a route for injected prompts and adversarial messages to spread and the structure topology-guided defenses use to locate risky agents.The cited work describes topology as governing the speed of unsafe-content spread.Source: §1 · p. 1
• Private prompts, tool outputs, and proprietary workflows keep labeled episodes siloed, while each operator sees only part of the attack distribution.The paper frames this as a graph federated-learning problem with scarce unsafe labels and non-IID client distributions.Source: §1 · pp. 1–2
• AUROC rises from 0.51 to 0.70 when the same detector is retrained in-domain, indicating that transfer failure reflects distribution shift rather than architecture.The paper argues that useful deployment therefore requires adaptation on each site's traces, which cannot be centrally pooled.Source: §1 · p. 2
• The evaluation tests whether federation can match pooled-training quality within a domain and gain cross-domain attack coverage without pooling traces.The paper presents privacy, multi-domain resilience, capability preservation, and deployment cost as goals for the guard.Source: §1 · p. 2
• FGLGuard federates an edge-featured graph attention detector with proximal local training, domain-balanced aggregation, over-refusal-constrained calibration, corroborated scoring, and one guarded rewrite.The design addresses non-IID clients, unequal silo sizes, benign-work blocking, upstream risk, and repairable answers.Source: §1 · p. 2

2 Related Work

• Message-level filters inspect messages in isolation, whereas topology-guided defenses model agent interactions to localize compromised agents or detect multi-hop risk.The cited topology-guided methods include graph pruning, temporal graphs, execution monitoring, and attention-based trust.Source: §2 · p. 2
• Unsupervised graph-anomaly guards avoid attack labels, but the paper says that motivation does not apply when runtime judges label episodes and reports lower detection quality.This distinguishes the paper's supervised setting from unsupervised anomaly detection.Source: §2 · p. 2
• Agent-workflow optimization targets utility and token efficiency but largely ignores adversarial propagation, making FGLGuard's topology interventions orthogonal to orchestration.The paper describes its intervention as applying to the topology produced by an orchestrator.Source: §2 · p. 2
• FGLGuard brings graph federated learning for disjoint whole-graph client datasets to agentic safety and adds threshold calibration under an over-refusal budget.Prior federated graph-learning applications cited here focus on recommendation, molecules, and citations.Source: §2 · p. 2

3 Problem Formulation

• An episode is a complete task execution represented over the last T rounds as an attributed graph with agent nodes, directed communication edges, and utterance-derived features.Edge features encode the receiving agent's per-round utterance embeddings; node features are anchored to agents' own utterance histories.Source: §3 · p. 2
• A safety judge assigns each episode a binary unsafe label, which the method broadcasts to all nodes for supervision.The reported AUROC is 0.708 with broadcast labels versus 0.705 with final-agent labeling across five seeds.Source: §3 · pp. 2–3
• Each operator holds disjoint private sets of labeled whole-episode graphs; raw episodes stay local and only model parameters are exchanged.Client distributions are modeled as non-IID through label-skew purity.Source: §3 · p. 3
• The objective trains a global per-agent risk scorer without exchanging raw graphs and maximizes unsafe-behavior detection subject to an explicit benign over-refusal budget.Episode-level AUROC uses the final-answer agent's raw score, while calibration and deployment use its corroborated score.Source: §3 · p. 3

4 Method

• FGLGuard has three stages: federated fitting of an edge-featured risk scorer, over-refusal-constrained threshold calibration, and runtime intervention with upstream-risk corroboration and at most one guarded rewrite.The server aggregates model updates, while each operator retains its raw prompts, messages, tool outputs, and episode graphs.Source: §4 · p. 3, Figure 2 · p. 4

4.1 Edge-Featured Risk Scorer

• Edge-conditioned attention folds neighboring agents’ messages into risk scores, while node features represent each agent’s own history.The edge-featured attention layer follows prior constructions; the node anchoring is the authors’ design.Source: §4.1 · p. 3

4.2 Federated Proximal Training

• Domain-balanced aggregation gives each domain equal total weight, with size-proportional weights within each domain; a single domain reduces to FedAvg.A proximal objective anchors clients with few or no unsafe episodes and limits drift toward the benign majority.Source: §4.2 · p. 3

4.3 Budgeted Operating-Point Calibration

• Calibration uses client-computed validation score-label pairs to select a threshold under an over-refusal budget, breaking recall ties toward lower FPR.The threshold is applied to corroborated scores so the calibrated operating point transfers to the live guard without retuning.Source: §4.3 · pp. 3–4

4.4 Corroborated Intervention Operator

• Before a high-impact action, the sidecar reconstructs the recent graph and corroborates the acting agent’s risk with upstream neighbors; blocked outputs are rewritten once and rescored.Corroboration can raise detection and false positives together at a fixed threshold, so calibration uses the corroborated score.Source: §4.4 · p. 4, Figure 2 · p. 4

5.1 Setup

• The evaluation covers Agent-SafetyBench, R-Judge, AgentDojo, and planted-attacker corpora, using four-agent episodes by default and matched gradient budgets across sharing strategies.Detection uses five seeds; live deployment uses one seed, and Table 1 reports AUROC plus guarded-MAS capability accuracy.Source: §5.1 · pp. 4–5, §5 · p. 4, Table 1 · p. 5

5.2 Main Results

• Federated FGLGuard exceeds pooled in-domain AUROC on all three organic benchmarks without raw traces leaving clients, while local-only training trails federation.The reported AUROCs are 0.726/0.895/0.680 for FGLGuard versus 0.695/0.810/0.676 for pooled training; local-only averages 0.666/0.762/0.584.Source: §5.2 · pp. 5–6
• Free judge labels outperform unsupervised and training-free guards on organic risk, where anomaly scores can be near chance and interactional risk may not be locally toxic.BlindGuard blocks 12–30% of benign capability traffic, while training-free alternatives reach only 0.533–0.574 on ASB and 0.417–0.534 on MA-CSQA.Source: §5.2 · p. 6
• One guard federated across four domains scores within 0.03 AUROC of multi-domain centralization on every domain; off-domain specialists score only 0.537–0.573.The federated and centralized five-seed means are 0.998/0.673/0.797/0.589 and 0.998/0.662/0.798/0.619, respectively.Source: §5.2 · p. 6

5.3 Ablations

• At fully pure label skew, the proximal objective scores 0.578 versus FedAvg’s 0.522; class reweighting is harmful at 5% unsafe prevalence.At p=0.8 and K=8, proximal training scores 0.667 versus FedAvg’s 0.646; 19× weighting reduces AUROC by 0.093 and recall at FPR≤0.10 from 0.221 to 0.009.Source: §5.3 · pp. 6–7

5.2 Main Results

• −43% targeted ASR accompanies clean utility rising from 0.575 to 0.650 on AgentDojo; FGLGuard preserves capability at zero API-token cost.Pooled ASR confidence intervals are disjoint from unguarded ([0.18, 0.28] versus [0.33, 0.46]); capability costs at most 2.1 points on the three Table 1 workloads.Source: §5.2 · p. 6, Figure 4 · p. 7

5.3 Ablations

• Detection tracks the centralized ceiling across team sizes and remains best under Qwen3-8B, while fixed-to-random topology transfer remains weaker than random-to-fixed transfer.At n=3, FGLGuard scores 0.550; at n=4–8 it scores 0.726/0.693/0.775/0.770/0.784. Under Qwen3-8B, it scores 0.637/0.731, ahead of in-domain centralized training at 0.580/0.708.Source: §5.3 · p. 7, Table 2 · p. 7
• Final-answer-only guarding avoids the completion loss of tool-call guarding, while corroborated re-checking improves both safety and completion in the rewrite path.Tool-call guarding yields completion 0.664 versus 0.725 for final-only; corroborated re-checking yields safety 0.647 versus 0.620 and completion 0.772.Source: §5.3 · p. 7

• FGLGuard reduces AgentDojo attack success by 43% while maintaining near-unguarded utility and incurring minimal capability loss.Source: §6 · p. 7
• The results indicate that adaptation to distribution shift does not require pooling sensitive interaction traces.Source: §6 · p. 7
• The authors identify simulated federation, deployment-specific calibration, and limited improvement on explicit refusal benchmarks as limitations.Source: §6 · p. 7

• The supplement presents the training and calibration algorithm, properties and proofs for aggregation, calibration, and corroboration rules.Source: Supplementary Material · p. 10
• It adds extended results that do not fit in the main paper.Source: Supplementary Material · p. 10
• It provides full experimental-setup details, verbatim prompts, and a reproducibility statement.Source: Supplementary Material · p. 10

A0 Training and Calibration Procedure

• Each round broadcasts global parameters, trains clients locally with BCE plus a proximal penalty, aggregates with equal domain mass, then calibrates a threshold under an FPR budget.Source: A0 Training and Calibration Procedure · p. 10

A0.1 Properties of the aggregation, calibration, and corroboration rules

• Domain balancing prevents silo size or sharding from buying influence; corroboration expands the blocked set, so its threshold must be recalibrated, with the FPR budget guaranteed only on calibration data.Source: A0.1 Properties of the aggregation,… · pp. 10–11

A.1 Source-domain (tool-injection) column

• Table 3 supplies the omitted tool-injection results; supervised detectors saturate there, while unsupervised guards’ healthy source-domain scores contrast with at-or-below-chance organic-episode scores.Source: §A.1 · p. 11, Table 3 · p. 11

A.2 Cross-domain federation

• Federation tracks the pooled ceiling on every domain, while off-domain specialists score 0.47–0.66; size weighting raises ASB .673→.704 but lowers R-Judge .797→.713 and AgentDojo .589→.519.Source: Figure 5 · p. 11, §A.2 · p. 11

A.3 Topology-transfer matrix

• Table 4 evaluates FGLGuard episode AUROC across train/test topology pairs, using 2,000 reexecuted ASB tasks and 400 held-out tasks per topology.Source: §A.3 · p. 11, Table 4 · p. 11

A.4 Unsupervised guards under topology shift

• On fixed-topology ASB re-executions, unsupervised guards remain at or below chance across topologies.Source: §A.4 · p. 12, Table 5 · p. 12

A.5 Block rates behind the capability columns

• On LiveCodeBench, FGLGuard flags 3% of benign debates, versus 51% for the judge and 22% for CoT self-check, which erase 24.4 and 6.1 accuracy points.Source: §A.5 · p. 12, Table 6 · p. 12

A.6 Independent-judge audit, per arm

• An independent gpt-5 audit of 100-episode subsamples preserves the guard ordering, and its safety rates match the shield’s on FGLGuard arms.Source: §A.6 · p. 12, Table 7 · p. 12

• FedAvg, FedProx, SCAFFOLD, and FedDC use OpenFGL with the backbone unchanged, while two methods required adapting its node-classification interface to episode graphs and per-node logits.Source: §A.7 · p. 12
• MOON applies its model-contrastive term per graph, drawing node representations toward the global model and away from the previous local model.Source: §A.7 · p. 12
• FGSSL uses cross-entropy plus a 0.1× edge-distribution structural-distillation term on hidden node embeddings; both adapted methods use size-weighted averaging.Source: §A.7 · p. 12

B.1 Corpora, class balance, and split hygiene

• Unsafe episodes make up 0.383–0.531 of the three benchmark test sets, and same-domain clients receive IID partitions unless a domain split is specified.ASB train/test unsafe fractions are 0.447/0.460; R-Judge 0.525/0.531; AgentDojo 0.391/0.383.Source: §B.1 · p. 12

A.8 Capability retention, all six benchmarks

• All six capability workloads use the same held-out benign split; GNN rows are calibrated on benign validation data, while training-free guards have no threshold to calibrate.The table shares an unguarded reference across rows.Source: §A.8 · p. 12, Table 8 · p. 13

B.1 Corpora, class balance, and split hygiene

• ASB train/test splits are task-disjoint, and all reported AUROC uses a disjoint 400-episode held-out file rather than client test shards.R-Judge and AgentDojo use fixed train/test trajectory splits.Source: §B.1 · pp. 12–13

B.2 MAS orchestration

• ASB episodes use four agents on random directed topologies with edge sparsity 0.2 and at most four rounds, under a shared anonymous-role prompt.The episodes are orchestrated with LangGraph.Source: §B.2 · p. 13

B.3 Judges

• Safety labels come from benchmark-specific sources, while a separate completion judge checks whether fulfillable tasks were actually completed from the action trace.ASB uses its official shield model, R-Judge uses human annotations, and AgentDojo uses programmatic security checks.Source: §B.3 · p. 13

B.4 Detector, training, and calibration hyperparameters

• Detector training, calibration, and offline evaluation run on CPU; one federated run takes a few CPU-minutes, while live deployment additionally uses GPU/API resources.Thresholds are calibrated on validation splits and frozen before test.Source: §B.4 · pp. 13–14, Table 9 · p. 14
• Calibration selects the threshold maximizing validation recall subject to FPR ≤ρ, breaking ties toward lower FPR; on benign-only workloads it enforces a benign block rate ≤ρ.For benign-only workloads, the procedure selects the smallest threshold meeting the block-rate constraint.Source: §B.4 · p. 14

B.5 Cross-domain federation protocol

• The cross-domain arm uses eight clients, two per domain, with equal 1,000-node contributions from each domain and evaluation on all four domains’ held-out test sets.The multi-domain centralized ceiling pools the same graphs at a matched gradient budget; reported cross-domain values are five-seed means.Source: §B.5 · p. 14

B.6 Deployment metrics

• ASB safety counts an unsafe episode as safe only when blocked, over-refusal is measured on fulfillable tasks, and AgentDojo reports checker-confirmed attack success and utility.Completion is conditional on fulfillability and judged from the executed action trace.Source: §B.6 · p. 14

C Reproducibility

• Detector training and evaluation run on CPU in minutes, and reproducing the detection tables requires no API access.Live-deployment arms require API access for agent LLMs and judges.Source: C Reproducibility · p. 14
• The release includes graph corpora, training and evaluation code, and trained checkpoints.Per-arm raw outputs for deployment tables are also included.Source: C Reproducibility · p. 14
• Live-deployment reproduction additionally requires API access for the agent LLMs and judges.The paper states that model versions are given in the main text.Source: C Reproducibility · p. 14