Source-linked AI summary
Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection
Longzhu He, Zelang Wen, Xinfeng Li, Sen Su, XiaoFeng Wang
TL;DR
MIRAGE addresses the confidentiality risk of communication topologies in LLM-based multi-agent systems. It shapes adversary-facing semantic evidence toward a phantom topology while preserving the genuine topology for task execution, substantially reducing topology-inference effectiveness while largely preserving task utility.
Problem
Communication topology confidentiality matters because optimized topologies encode design expertise and valuable intellectual property.
Source: §1 · pp. 1–2Method
MIRAGE synthesizes a structurally distinct phantom topology, realizes its edges as plausible semantic dependencies, and suppresses cues for genuine edges absent from it while preserving the genuine topology for execution.
Source: §1 · p. 2, §4.2 · p. 5, §7 · p. 9Results
Across three topology optimization strategies and four benchmark datasets, MIRAGE reduces topology-inference performance while largely preserving task utility.
Source: §5.2 · p. 7Takeaways & Limitations
MIRAGE conceals the genuine communication topology while introducing only minor task-utility degradation across the evaluated settings.
Source: §5.2 · p. 7, §7 · p. 9The threat model is a strict black-box attacker limited to queries and final responses, without access to internal information or the ability to modify the system.
Source: §3 · p. 3
Abstract
from arXiv · showhide
Driven by the rapid advancement of large language models (LLMs), LLM-based multi-agent systems (MAS) have emerged as a powerful paradigm for collaborative reasoning over complex tasks. A key design element of MAS is the communication topology, which governs information flow among agents and often encodes proprietary knowledge about the system architecture. However, recent work has shown that such topologies can be inferred even in black-box settings by exploiting semantic dependencies in observable reasoning traces, posing significant risks of intellectual property leakage and exposure of system vulnerabilities. To address this threat, we propose MIRAGE, a topology-concealment framework that preserves the genuine communication topology for task execution while shaping adversary-facing semantic evidence toward a carefully constructed phantom topology. Specifically, MIRAGE operates in three stages: (1) phantom topology synthesis, (2) semantic edge realization, and (3) protected MAS execution. It constructs a phantom topology structurally distinct from the genuine one, materializes phantom edges as plausible semantic dependencies, and suppresses source-specific cues that could reveal genuine edges absent from the phantom topology. Extensive experiments across three topology optimization frameworks and four benchmark datasets demonstrate that MIRAGE substantially reduces the effectiveness of topology inference attacks while largely preserving the task utility of the protected MAS.
1 INTRODUCTION
LLM-based multi-agent systems rely on communication topologies that guide information flow and can embody proprietary design expertise. MIRAGE addresses the risk that semantic dependencies in observable traces reveal those topologies, aiming to conceal them while preserving task utility.
Research Gap
- Prior work has focused on communication-content attacks, leaving topology confidentiality relatively underexplored, and existing defenses largely address content-level security.The central challenge is disrupting evidence of the true topology while preserving information flow needed for task execution.Source: §1 · pp. 1–2
Security Motivation
- Topology-inference attacks exploit semantic dependencies in observable reasoning traces to reconstruct genuine communication structures, risking exposure of system architecture and vulnerabilities.Topology can encode design expertise and intellectual property, while leaked structures can expose critical agents and pathways.Source: §1 · pp. 1–2, Figure 1 · p. 2
Proposed Defense
- MIRAGE separates the topology used for task execution from adversary-facing evidence by constructing a structurally distinct phantom topology.It materializes phantom edges as plausible task-relevant dependencies and suppresses source-specific cues of genuine edges absent from the phantom topology.Source: §1 · p. 2
Evaluation Scope
- The paper evaluates MIRAGE across general reasoning, mathematical reasoning, and code generation benchmarks.The benchmarks are MMLU, GSM8K, SVAMP, and HumanEval.Source: §1 · p. 2
Extensive Evaluation
- MIRAGE substantially reduces topology-inference effectiveness while largely preserving task utility across three topology-optimization frameworks and four benchmark datasets.The datasets are MMLU, GSM8K, SVAMP, and HumanEval.Source: §1 · p. 2
2 PRELIMINARIES
The preliminaries formalize an LLM-based multi-agent system and its communication topology, describe black-box topology inference, and define protection as increasing topology discrepancy subject to bounded utility degradation.
LLM-based MAS
- An LLM-based multi-agent system is represented as S = (P, G), with agent profiles P and a directed acyclic communication graph G.Profiles specify agent prompts, callable tools, and other configuration details; graph edges represent directed communication.Source: §2 · p. 3
Topology Inference Attack
- Topology-inference attacks use black-box queries and system responses to reconstruct hidden communication edges from semantic dependencies among exposed intermediate outputs.CIA is described as eliciting intermediate reasoning outputs and exploiting their semantic dependencies.Source: §2 · p. 3
Problem Definition
- The defense objective is to maximize the discrepancy between inferred and genuine topologies while keeping task-utility degradation within a specified bound.The formulation defines topology discrepancy, task utility, and the maximum allowable utility degradation.Source: §2 · p. 3
3 THREAT MODEL
The threat model considers a black-box adversary trying to reconstruct an MAS communication topology, while the defense seeks to protect that topology without disrupting execution.
Adversary’s Objectives
- The adversary aims to reconstruct the true topology because its disclosure can reveal critical agents and communication pathways that facilitate targeted attacks.Leaked topology can also expose proprietary architectural design and enable unauthorized system replication.Source: §3 · p. 3
Adversary’s Capabilities
- A black-box adversary can submit chosen queries and observe final system responses but cannot directly access agent profiles, prompts, intermediate messages, or the true topology.Adversarial queries may nevertheless induce the system to expose information about intermediate agent outputs.Source: §3 · p. 3
- The adversary cannot modify agent configurations, communication edges, or other internal system components during an attack.Source: §3 · p. 3
Defense Overview
- MIRAGE’s overview depicts three stages: phantom-topology synthesis, semantic-edge realization, and protected execution that retains the genuine topology for tasks.The adversary-facing dependency evidence is aligned with the phantom topology.Source: Figure 2 · p. 4
4 METHODOLOGY
MIRAGE separates the genuine topology used for task execution from adversary-facing evidence through phantom topology synthesis, semantic edge realization, and protected execution.
4 METHODOLOGY
- MIRAGE preserves the genuine topology for task execution while shaping adversary-facing semantic evidence toward a structurally distinct phantom topology.The workflow comprises phantom topology synthesis, semantic edge realization, and protected MAS execution.Source: §4 · p. 4, §4.1 · p. 4, §4.2 · p. 5
4.1 PHANTOM TOPOLOGY SYNTHESIS
- Phantom synthesis rewires edges while preserving agents, execution order, acyclicity, and paths to the decision agent.The structural camouflage ratio measures edge overlap; the topology anonymity set counts feasible alternatives meeting a minimum deviation threshold.Source: §4.1 · p. 4
4.2 SEMANTIC EDGE REALIZATION
- For each phantom edge, an LLM generator creates dependency evidence conditioned on source and target profiles, source output, query, and target context.Generated evidence follows role consistency, task relevance, and dependency plausibility.Source: §4.2 · p. 5
- For genuine edges absent from the phantom topology, MIRAGE paraphrases traces and selects versions that suppress dependency cues while preserving task-relevant semantics.Selection balances semantic distortion against semantic dependency strength.Source: §4.2 · p. 5
4.3 PROTECTED MAS EXECUTION
- Agents execute over the genuine topology, while the exposure view combines obfuscated genuine traces with phantom evidence aligned with the phantom topology.This dual-view design is intended to conceal the genuine topology with minimal impact on task utility.Source: §4.3 · p. 5
5 EXPERIMENTS
The experiments evaluate MIRAGE across three topology optimization frameworks and four datasets, testing topology protection, task utility, component and parameter effects, and representative cases. MIRAGE reduces topology-inference effectiveness while largely preserving task utility.
5.1 EXPERIMENTAL SETTINGS
- The evaluation uses 100 sampled tasks from each of four datasets, three topology-optimization frameworks, and topology-protection and task-accuracy metrics.Datasets cover general reasoning, mathematical reasoning, and code generation; topology inference is measured by AUC, ACC, and F1.Source: §5.1 · p. 6
5.2 RESULTS & DISCUSSION
- Across three topology optimization strategies and four datasets, MIRAGE consistently reduces topology-inference AUC, ACC, and F1; it also outperforms Instruction and Delimiters.Figure 5 illustrates the No Defense versus MIRAGE comparison for ARG-Designer.Source: §5.2 · p. 7, Figure 5 · p. 7
- Across three strategies and four datasets, MIRAGE largely preserves original task utility despite substantially reducing topology-inference performance.The reported task-accuracy variations are minor.Source: §5.2 · p. 7, Figure 7 · p. 8
- On G-Designer with MMLU, removing either phantom edge materialization or genuine edge obfuscation increases AUC, ACC, and F1.The ablation identifies both components as essential for topology concealment.Source: §5.2 · p. 7
- On G-Designer with MMLU, the structural-deviation threshold trades off concealment and utility, paraphrase benefits saturate beyond M = 5, and moderate λ balances suppression with semantic preservation.The analysis varies ρ0, M, and λ.Source: §5.2 · p. 7
- CIA recovers most genuine edges before defense, whereas after MIRAGE its inferred topologies substantially deviate from ground truth across all three optimization methods.The visualized defended structures include concealed genuine edges or replaced phantom relations.Source: §5.2 · p. 8
6 RELATED WORK
Related work spans LLM-based multi-agent systems, adversarial attacks, and MAS privacy and security. It identifies topology confidentiality as distinct from content-level threats and as a comparatively underexplored defense target.
LLM-based Multi-Agent Systems
- LLM-based MAS coordinate specialized agents through structured communication, with research progressing from handcrafted structures to task-adaptive topology optimization.G-Designer, AGP, and ARG-Designer optimize connectivity through graph-based generation or pruning.Source: §6 · p. 8
Adversarial Attacks against MAS
- Prior MAS attacks target agent behavior, communication, or task execution, while CIA infers topology from semantic dependencies under black-box access.Defenses against topology inference remain largely unexplored.Source: §6 · p. 8
Privacy and Security Protection for MAS
- Existing MAS privacy and security defenses primarily protect message content or system behavior, leaving communication-topology confidentiality comparatively overlooked.MIRAGE is presented as concealing topology from black-box inference while preserving it for task execution.Source: §6 · p. 9
7 CONCLUSION
MIRAGE addresses black-box topology inference by separating genuine task execution from adversary-facing exposure. Across multiple optimization methods and datasets, it reduces inference effectiveness while largely preserving task utility.
7 CONCLUSION
- MIRAGE protects LLM-based MAS communication topologies against inference by decoupling genuine task execution from adversary-facing exposure.Its three stages are phantom topology synthesis, semantic edge realization, and protected MAS execution.Source: §7 · p. 9
- The framework reshapes observable semantic dependencies through phantom edge materialization and genuine edge obfuscation while retaining the genuine topology for execution.Source: §7 · p. 9
- Experiments across multiple topology optimization methods and benchmark datasets show reduced topology-inference effectiveness with task utility largely preserved.The paper points to Appendix E for limitations and future directions.Source: §7 · p. 9