Source-linked AI summary
Trust-Aware Adaptive Disclosure for Inference Privacy Preservation in Multi-Agent Networks
Puspanjali Ghoshal, Tobias J. Oechtering
TL;DR
Multi-agent communication can expose latent goals and other sensitive information while agents coordinate on shared objectives. The paper proposes Trust-Aware Privacy Control, which adapts stochastic message disclosure to inter-agent trust; experiments report reduced inference leakage with competitive consensus performance.
Problem
Multi-agent systems require local information exchange for distributed coordination, but communication can expose sensitive goals, preferences, intentions, and commercially sensitive operating plans to adversaries.
Method
Trust-Aware Privacy Control dynamically regulates probabilistic information disclosure based on inter-agent trust, reducing exposure to low-trust agents while preserving communication with trusted neighbours.
Results
Experimental analysis reports improved privacy-utility tradeoffs, with TAPC consistently reducing inference leakage while maintaining competitive consensus performance against baseline methods.
Takeaways & Limitations
Adaptive trust-aware stochastic control supports privacy-preserving consensus by balancing information exposure against consensus utility.
Takeaways & Limitations
The formulation assumes each agent has a private goal variable drawn from a finite goal space.
Abstract
from arXiv · showhide
Agent based systems are increasingly deployed in information critical systems including healthcare management systems, and smart grids. In this paper, we consider a multi-agent system where each agent has a latent goal that needs to be kept hidden from observing adversaries. More specifically, this paper studies privacy-preserving consensus in networked multi-agent systems under goal inference attacks. We propose a Trust-Aware Privacy Control framework that adapts message disclosure based on the dynamic trust relationships between agents. The proposed method controls information release using a trust-dependent stochastic policy. This enables a tradeoff between consensus performance and privacy preservation. Experiments demonstrate that the proposed method reduces adversarial goal inference accuracy compared to representative baselines, while maintaining competitive consensus utility, thereby highlighting the effectiveness of trust-aware mechanisms in privacy preservation of the agents in multi-agent systems.
1. INTRODUCTION
Multi-agent communication can expose latent goals and other sensitive information to inference attacks, creating a need for decentralized privacy-preserving coordination. TAPC links stochastic disclosure to inter-agent trust to reduce leakage while retaining useful communication and consensus utility.
- Local communication in multi-agent systems can expose agents’ goals, preferences, and intentions to adversaries.
- Smart-grid participants must coordinate operationally while limiting disclosure of commercially sensitive production strategies, reserve capacities, and operating plans.
- Existing differential-privacy and additive-noise approaches can degrade system performance, while trust-aware inference-privacy integration remains underexplored.
- TAPC dynamically regulates disclosed information using inter-agent trust, reducing exposure to low-trust agents while preserving communication with trusted neighbours.
- The paper contributes a probabilistic disclosure mechanism, a theoretical trust-leakage characterization, and experiments on privacy-utility tradeoffs.
- TAPC uses trust as a privacy-control variable for selective disclosure, adapting to network heterogeneity while reducing adversarial goal-inference capability.
3. PROBLEM FORMULATION
The formulation models agents with observable states and private latent goals communicating over a network monitored by a knowledgeable passive adversary. It defines inference from observable message histories while accounting for trust-related leakage risk.
- 3. PROBLEM FORMULATION: The multi-agent system is represented by an undirected graph whose vertices are agents and edges are communication links.
- 3. PROBLEM FORMULATION: Each agent has an observable state and a private latent goal drawn from a finite goal space that unauthorized entities must not infer.
- 3. PROBLEM FORMULATION: Agents transmit messages to neighbours, and each agent’s communication history records those messages over the time horizon T.
- A. Threat Model: The threat model uses a passive adversary that observes exchanges and exploits temporal communication patterns to infer hidden goals.
- A. Threat Model: The adversary is assumed to know the communication protocol and network topology but not agents’ internal states or latent goals.
- A. Threat Model: Only communication links in the adversary’s observable-link set contribute to its collected communication history.
- A. Threat Model: The adversary applies an inference model to the observed history, and inference success probability measures its goal-inference performance.
- A. Threat Model: Low-trust agents are treated as higher leakage risks and may also act as inference adversaries.
B. Trust-Aware Communication Model
The communication model makes disclosure depend on the receiver’s trust level, producing trust-dependent histories and leakage. It measures privacy through mutual-information-based inference loss, where lower leakage indicates stronger resistance.
- B. Trust-Aware Communication Model: Each agent assigns a trust level τij ∈[0, 1] to neighbouring agents, and a trust-aware policy generates transmitted messages.
- B. Trust-Aware Communication Model: The policy adjusts the amount of information disclosed according to the receiver’s trust level.
- B. Trust-Aware Communication Model: Because the policy depends on trust, the resulting communication history and adversary-observed history depend on the network trust profile.
- B. Trust-Aware Communication Model: Highly trusted neighbours receive more information, whereas low-trust neighbours receive increasingly obfuscated information.
- C. Inference Privacy Metric: Inference privacy loss is defined per agent from the mutual information between latent goals and communication history, with network leakage averaged across agents.
- C. Inference Privacy Metric: A smaller value of L(τ) indicates stronger resistance against goal-inference attacks.
- C. Inference Privacy Metric: Mutual information captures average information leakage and is practical for inference risk, although estimating it from high-dimensional histories is challenging.
D. Task Utility
The framework combines trust evaluation, adaptive disclosure, privacy-preserving message generation, and leakage-aware optimization to balance cooperative utility against inference privacy. Trust scores combine communication reliability and behavioral consistency within bounded trust values.
- D. Task Utility: The cooperative objective is represented by U = U(x, m), covering consensus accuracy, formation stability, tracking performance, or distributed optimization efficiency.
- E. Problem Statement: The design seeks to minimize communication-based goal inference while preserving cooperative task performance and communication efficiency.
- E. Problem Statement: The optimization minimizes adversarial information about latent goals subject to minimum task utility and communication constraints.
- Framework Components: The framework comprises trust evaluation, adaptive disclosure control, privacy-preserving message generation, and leakage-aware optimization.
- A. Trust Evaluation Model: Agents compute neighbour trust scores from historical communication behaviour and interaction outcomes.
- A. Trust Evaluation Model: Reliability counts successful and total interactions within an observation window, while behavioural consistency compares recent communication with historical patterns.
- A. Trust Evaluation Model: The parameter λ controls the relative importance of reliability and behavioural consistency in the trust score.
- A. Trust Evaluation Model: Trust scores remain within [0, 1], with higher values indicating more reliable partners and lower values indicating potential leakage risk.
B. Trust-Based Disclosure Control
The framework regulates information sharing through a trust-dependent disclosure coefficient and selective feature transmission. Higher disclosure reveals more task-relevant information, while lower disclosure strengthens privacy protection and trusted neighbours receive less-obfuscated messages.
- Each communication link receives a disclosure coefficient to regulate information sharing.
- The coefficient ranges from 0 to 1, with values near one disclosing more task-relevant information.Smaller values correspond to stronger privacy protection.
- The mechanism extracts a task-relevant feature from an agent’s observable state and latent goal before message generation.The feature mapping is application-dependent.
- Gaussian perturbation supplies the obfuscation signal in the trust-dependent disclosure mechanism.
- Highly trusted neighbours receive more informative messages, whereas low-trust neighbours receive increasingly obfuscated information.The adaptive trust-dependent disclosure policy is the framework’s focus, while alternative perturbation mechanisms may also be incorporated.
D. Leakage Upper Bound
The analysis models adversarial observations as an AWGN channel and connects trust-aware disclosure to inference leakage through signal-to-noise ratio and channel capacity. The implementation updates trust and disclosure and generates messages across links each communication round.
- The disclosure coefficient directly affects the signal-to-noise ratio available to the adversary.
- The effective signal-to-noise ratio is defined using the average power of the task-relevant feature.
- The adversarial observation process is approximated as an AWGN channel whose mutual information is bounded by Shannon channel capacity.
- The capacity bound links trust-aware disclosure to inference leakage because the latent goal influences the transmitted feature.Goal-inference information cannot exceed the information contained in the observed communication channel.
- Algorithm 1 computes reliability and consistency, updates trust, computes disclosure, generates noise, constructs messages, and transmits them on each link.
- The overall computational complexity per communication round is O(|E|).
5. THEORETICAL ANALYSIS
Theoretical results establish monotonic relationships between disclosure, trust, sensitivity, and inference leakage. They also identify a simplified instantaneous setting as a scope boundary for the preliminary leakage analysis.
- For fixed noise variance, the inference leakage upper bound increases monotonically with the disclosure coefficient αij.
- For fixed noise variance and sensitivity, the inference leakage upper bound increases monotonically with trust score τij.Highly trusted links reveal more information to receivers and potentially to observing adversaries.
- The derivative-based proof connects changes in trust to leakage through the disclosure coefficient.
- For fixed trust, increasing the sensitivity parameter γ reduces the inference leakage upper bound.γ therefore provides a tunable privacy-control parameter without changing trust evaluation.
- The preliminary leakage analysis considers a simplified instantaneous setting.Alternative message-generation mechanisms and dynamic temporal message history are left for future extensions.
6. EXPERIMENTS AND RESULTS
The experiments evaluate TAPC against three representative baselines using consensus utility, inference leakage, and communication cost.
- TAPC is evaluated against three representative baseline methods on consensus utility, inference leakage, and communication cost.
A. Experimental Setup
The experiments compare TAPC with full disclosure, Gaussian noise, and trust-thresholded communication using consensus utility, inference leakage, and communication cost. TAPC preserves competitive utility while achieving the lowest inference leakage among evaluated methods.
- A. Experimental Setup: The experiment uses 50 agents, six latent-goal classes, 100 communication rounds, and a machine-learning adversary observing communication histories.
- A. Experimental Setup: The evaluation compares TAPC against full disclosure, Gaussian noise, and trust-thresholded communication.The methods are assessed using consensus utility, inference leakage, and communication cost.
- A. Experimental Setup: FD achieves the highest consensus utility, GN degrades utility through injected noise, and TAPC maintains competitive utility with stochastic privacy protection.TOC improves utility by selectively preserving communication on high-trust links.
- A. Experimental Setup: TAPC achieves the lowest inference leakage among all evaluated methods.The leakage evaluation uses a random forest adversary trained on statistical features from temporal communication histories.
D. Privacy–Utility Pareto chart
The privacy–utility comparison places TAPC at a strong Pareto-efficient operating point while maintaining competitive consensus performance. Communication cost is identical across methods at fixed network size and increases with the number of agents for TAPC.
- D. Privacy–Utility Pareto chart: TAPC achieves a strong Pareto-efficient operating point among the evaluated methods.FD occupies the high-utility, high-leakage extreme; GN lowers leakage with reduced performance; TOC provides an intermediate tradeoff.
- E. Communication Cost: At fixed agent count, all methods incur identical communication cost because every agent communicates over all edges at each iteration.
- E. Communication Cost: TAPC communication cost increases steadily as the number of agents increases.This scaling behavior is depicted in Figure 4.
- D. Privacy–Utility Pareto chart: TAPC consistently reduces inference leakage while maintaining competitive consensus performance compared with baseline methods.
- D. Privacy–Utility Pareto chart: TAPC uses trust-dependent stochastic masking to adaptively regulate information disclosure during inter-agent communication.The framework differs from uniform noise injection and hard trust thresholding.