PaperlayerView exact revision on arXiv

Source-linked AI summary

Selection-Invariant Communication Compilers for Privacy-Aware Multi-Agent LLM Workflows

Jinghan Xu, Longze Fan, Zeyuan Wang, Xinjin Li, Hankai Liu

arXiv:2609.26076v1cs.AIcs.CR

TL;DR

Intermediate communication can expose private state even when final outputs are safe, and choosing among valid authorized message forms can itself create an inference channel. SICC constrains that post-authorization representation policy rather than prescribing one renderer. Evaluations report preserved protocol utility without a statistically detectable positive excess-gain signal under the tested attackers and schemas.

  • Problem

    Intermediate messages can reveal private reasons or correlated operational facts, while existing defenses leave the choice of how an authorized release is expressed unresolved.

    Source: Introduction · p. 1

  • Method

    SICC constrains observable message generation to depend on authenticated public inputs and authorization policy, using auditable renderers that instantiate only authorized fields.

    Source: Introduction · pp. 1–2, Overview · p. 3

  • Results

    132-scenario AgentLeak replay and LangGraph evaluation show deterministic and public-randomized SICC preserve complete protocol success with no statistically detectable positive excess gain under evaluated attackers and schemas.

    Source: Introduction · p. 2

  • Takeaways & Limitations

    Selection invariance is a post-authorization communication-layer principle: a compliant message adds no information beyond the complete authorized view, which may itself be informative.

    Source: Conclusion · p. 7

    SICC constructs a certifiable feasible policy but does not claim global optimality over all utility-preserving generators.

    Source: Introduction · p. 1

Abstract

from arXiv · show

Structured multi-agent workflows exchange intermediate messages whose content and form can reveal private state even when the final output is safe. We identify selection-channel leakage: after authorization fixes what may be released, a private-state-aware choice among semantically valid realizations creates an additional inference channel. We introduce the selection-invariant communication compiler(SICC), which constrains this post-authorization representation kernel rather than prescribing templates. Any deterministic or independently public-randomized generator satisfying the invariant is valid; requirement-indexed canonical forms are one auditable implementation. We prove a compositional communication-layer guarantee: authorization, public-only form generation, and a dependency-safe utility gate make the emitted transcript reveal no information beyond the complete authorized view. Private-state-aware selection remains vulnerable after surface-disjoint and length-matched controls. Across 132 AgentLeak communication replays and 100 executable LangGraph tasks, deterministic SICC retains complete protocol utility without a positive excess-gain signal; independent public randomization preserves the same result in AgentLeak and 480 controlled cases.

Introduction

Intermediate messages can reveal private state even when final outputs appear safe, and existing content- and access-control defenses leave the choice of authorized message form unaddressed. SICC constrains that post-authorization choice and is evaluated against leakage while preserving protocol utility.

Introduction

  • Intermediate transcripts can reveal private reasons or correlated operational facts, while prompting, guarding, redaction, and access control leave how authorized information is expressed unresolved.A private-state-dependent choice among valid realizations of the same authorized release creates the additional channel called selection-channel leakage.Source: Introduction · p. 1
  • Equation (1) is a policy-design objective, not an online optimization; SICC constructs a certifiable feasible policy without claiming global optimality over utility-preserving generators.The policy must satisfy authorization, selection invariance, and protocol utility.Source: Introduction · p. 1
  • Any deterministic or independently public-randomized generator can comply if message form avoids dependence on private state and instantiated values are authorized.Requirement-indexed canonical forms make dependencies auditable; OLRS is a nondeployable diagnostic that illustrates how leakage-ranked selection can induce form leakage.Source: Introduction · p. 1
  • SICC's guarantee is policy-relative: access enforcement determines what may be released, while SICC constrains its representation and does not hide information already in the public or authorized view.Its objective is to prevent additional inference from undeclared fields or private-state-dependent variation in message form.Source: Introduction · pp. 1–2
  • 132-scenario AgentLeak replay and LangGraph evaluation show deterministic and public-randomized SICC preserve complete protocol success with no statistically detectable positive excess gain under evaluated attackers and schemas.Redaction and operational-fact sharing preserve utility but yield 0.738 ± 0.019 excess attacker accuracy; OLRS retains 0.225±0.019 through selection and 0.207 FormGain after semantic masking and exact length matching.Source: Introduction · p. 2
  • SICC formalizes selection invariance: observable message generation depends on authenticated public inputs and authorization policy, not private state or private-state-dependent rankings.Its stated contributions include controlled, benchmark-replay, and LangGraph evaluations of privacy, utility, robustness, and workflow integration.Source: Introduction · pp. 1–2

Related Work

Related work studies context-sensitive disclosure, communication optimization, information-flow controls, and inference leakage. SICC's distinction is to constrain the policy selecting among valid message forms after authorization.

Contextual privacy and selective disclosure

  • Contextual privacy and agent defenses regulate communicated content, while SICC additionally constrains selection among valid message forms after authorization.The cited approaches include context-dependent disclosure norms and task-sufficient abstractions.Source: Related Work · p. 2

Communication optimization and inference leakage

  • Learned communication protocols trade retained task information or communication cost against coordination performance, whereas SICC constrains the message-producing policy distribution.Even a short or individually sanitized message may leak when its form depends on private state.Source: Related Work · p. 2
  • This work studies inference of case-level latent state from legitimate inter-agent transcripts conditioned on the declared public view, distinguishing it from memorization or identifying-information attacks.Training-data extraction and PII inference instead target memorized or identifying information in model outputs.Source: Related Work · p. 2

Information flow and choice-dependent side channels

  • Information-flow and side-channel research provides broader foundations; SICC isolates and formalizes the post-authorization distribution over valid natural-language realizations for inter-agent communication.Prior work covers protected influence, authorized release, attacker knowledge gain, data-flow boundaries, and observable choices that reveal protected state.Source: Related Work · p. 2

Problem Formulation

The formulation separates authorized content from observable message form: a transcript can reveal private state through explicit content or through state-dependent choice among valid forms.

Task and Threat Model

  • The sender holds context X that may correlate with private state S, while the compiler receives (X, Y, R) and an authenticated policy catalog but never S.Source: Task and Threat Model · p. 2
  • Authorization fixes permitted fields independently of the current case’s S, and the authenticated receiver requirement cannot expand the authorized projection.Source: Task and Threat Model · p. 2
  • The attacker observes the pre-message view and optionally the transcript, then attempts to infer S; the evaluation label is unavailable to the deployed compiler.Source: Task and Threat Model · p. 2
  • The guarantee assumes sound authorization and an S-independent projection and generation policy; incorrectly authorized fields remain outside its scope.Source: Task and Threat Model · pp. 2–3

Communication Leakage Channels

  • Content leakage exposes private labels or correlated facts, while selection leakage exposes private-state-dependent form choices even when candidate messages are individually sanitized.Source: Communication Leakage Channels · p. 3

Metrics

  • ExcessGainA compares attacker accuracy on paired views with identical Opub and transcript against the pre-message view, serving as a proxy—not an equality—for conditional mutual information.Source: Metrics · p. 3
  • ExcessGainO can rise when a transcript adds authorized values absent from Opub, even if those values add nothing beyond the complete authorized view.Source: Metrics · p. 3
  • FormGain isolates inference from observable form, but low FormGain does not establish low content leakage unless every instantiated field is authorized.Source: Metrics · p. 3

Methodology

SICC compiles authorized communication through public-input-based form generation, dependency checks, and protocol validation, with a communication-layer guarantee against additional leakage beyond the authorized view.

Overview

  • SICC combines authenticated policy retrieval, authorized projection, selection-invariant rendering, dependency checking, and exact protocol validation.Its deterministic implementation uses requirement-indexed canonical forms for direct dependency auditing.Source: Overview · p. 3

Operational Compiler

  • The renderer is indexed by authenticated requirements and policies, while removing undeclared content and private-state-dependent form selection without hiding authorized values.Unmet requirements trigger abstention or escalation.Source: Operational Compiler · p. 3, Table 1 · p. 4, Table 2 · p. 4

Selection Invariance and Guarantees

  • Any generator is admissible when observable form is independent of private state given public inputs and policy, and its fields and utility satisfy the stated constraints.Deterministic and independently public-randomized rendering are both permitted; the invariant constrains dependencies, not wording.Source: Selection Invariance and Guarantees · pp. 4–5
  • The compositional guarantee is no information beyond the authorized view, assuming authorized values, public-only form generation, and a dependency-safe utility gate.A fixed abstention token prevents the accept/reject outcome from encoding residual private state.Source: Selection Invariance and Guarantees · pp. 4–5

Privacy-Label-Free Deployment

  • SICC needs no per-message private-state labels or taint metadata, relying on authenticated requirements and authorization systems to establish the trusted boundary.Those systems establish the boundary; SICC enforces the post-authorization communication contract.Source: Overview · p. 3, Privacy-Label-Free Deployment · p. 5

Experiments

Across controlled attacks, AgentLeak replays, and executable workflows, SICC limits transcript-induced leakage while preserving receiver utility. The experiments also show that authorization, form invariance, and utility gating address distinct failure modes.

Setup

  • The controlled evaluation uses enterprise, healthcare, and HR tasks, held-out attackers, shared receiver cases, and practical baselines given the same sender context and receiver requirements.Training and test sets contain 2,400 and 900 cases; evaluation uses paired bootstrap intervals and corrected McNemar tests.Source: Setup · p. 5

Diagnosing Message-Form Leakage

  • FormGain persists after masking case-specific information and matching message length, while SICC remains at the pre-message baseline.The audit uses 900 cases and 64-token masked messages.Source: Diagnosing Message-Form Leakage · p. 5, Table 3 · p. 5
  • Only full SICC jointly satisfies authorization, form invariance, and receiver completeness; each ablation exposes undeclared values, leaks through form choice, or omits required fields.The component ablation covers 132 AgentLeak replays.Source: Diagnosing Message-Form Leakage · p. 5, Table 4 · p. 5

Transcript Leakage and Adaptive Attacks

Receiver Utility and Human Evaluation

  • On 480 shared cases, SICC achieves .946 completion under Qwen and 1.000 under Mistral with −.008 ExcessGain; human assessment gives .960 sufficiency and .040 unnecessary disclosure.Receipt-only communication satisfies only .338 of exact receiver requirements.Source: Receiver Utility and Human Evaluation · p. 6, Table 7 · p. 7

Public-Benchmark and Workflow Evaluation

Schema Coverage and Operational Cost

  • Seen and unseen slot-compatible requirements achieve receiver success 1.00 with near-zero excess gain, while raw-evidence requests are rejected; natural-language policy parsing is not evaluated.The authenticated-envelope test assumes structured authenticated inputs.Source: Schema Coverage and Operational Cost · p. 7
  • Operational SICC uses policy retrieval, authorized projection, rendering, dependency validation, and an exact rule check without candidate generation, attacker scoring, or LLM calls.Source: Schema Coverage and Operational Cost · p. 7

Conclusion

SICC treats privacy in structured workflows as a matter of controlling both correlated content and its representation policy. Evaluations found no statistically detectable positive excess gain for SICC under the tested conditions, while private-state-aware selection leaked through message form.

Conclusion

  • Across controlled, AgentLeak, LangGraph, and receiver evaluations, SICC showed no statistically detectable positive excess gain, while private-state-aware selection leaked through form.Source: Conclusion · p. 7
  • The theorem guarantees that a compliant message adds no information beyond the complete authorized view, which may itself be informative.Source: Conclusion · p. 7
  • SICC is a renderer-independent post-authorization communication-layer principle, not an end-to-end secrecy claim.Source: Conclusion · p. 7
Loading 2609.26076v1…