PaperlayerView exact revision on arXiv

Source-linked AI summary

When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems

Sunday Oyinlola Ogundoyin, Muhammad Ikram

arXiv:2610.16039v1cs.CRcs.AIcs.CL

TL;DR

Multi-agent systems can pass protected information from an authorized agent to an unauthorized one through routine coordination, a leakage problem not captured by sensitivity alone. The paper measures topology-conditioned recipient exposure and introduces RECONS, which decides whether to transform a value based on the recipient and execution context. Topology changes recipient exposure while surface leakage stays comparatively stable, and RECONS reduces residual disclosure while retaining authorized disclosures.

  • Problem

    Multi-agent coordination can propagate an authorized disclosure to an unauthorized recipient, while prior approaches do not make the recipient about to receive a value their central decision condition.

    Source: §1 · p. 1

  • Method

    The paper evaluates topology-conditioned exposure and introduces RECONS, a Detect → Decide → Transform sanitizer that conditions intervention on recipient authorization.

    Source: §1 · p. 2, §3.2 · p. 4

  • Results

    Topology changed recipient exposure from 0% to 52.2% while surface leakage moved only 2.2 points; RECONS reduced residual disclosure to 29.25% and retained 94.1% of authorized disclosures.

    Source: §8 · pp. 18–19

  • Takeaways & Limitations

    Privacy controls for multi-agent systems must account for the recipient and communication path realized at runtime, not static topology, framework, or model assumptions alone.

    Source: §8 · p. 19

    Detection coverage remains constrained by lower recall on structured channels, textual ambiguity for identifiers and canary-like tokens, and dependence on the calibrated Tier-3 judge.

    Source: §6.3.6 · p. 14

Abstract

from arXiv · show

Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to one authorized agent can propagate through routine coordination to an unauthorized one, without compromise or malicious behavior. This motivates topology-aware enforcement that blocks unauthorized propagation while preserving authorized disclosure. We evaluate 485 scenarios across coordinator-worker, peer-to-peer, and hierarchical topologies, instrumenting seven communication channels and measuring surface leakage and disclosure to topology-introduced recipients. We introduce RECONS, a Detect -> Decide -> Transform sanitizer conditioning intervention on recipient and execution context rather than sensitivity alone. Topology changes where protected information propagates, with disclosure to topology-introduced recipients rising from 0% to 52.2% while surface leakage stays nearly flat at 60.6-62.8%. This effect persists across four generator models and a second orchestration framework, though magnitude and relay paths differ; framework choice separately drives a 150x leakage spread, so topology alone is not sufficient. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction. Detection coverage is the dominant bottleneck, accounting for 95.5% of residual disclosures. These results show that privacy enforcement in MALS must reason about the recipient and communication path realized at runtime, not sensitivity or topology assumptions alone.

1 Introduction

In multi-agent systems, an authorized disclosure can propagate through routine coordination to an unauthorized recipient without compromise or malicious behavior. The paper measures topology-conditioned exposure and introduces RECONS to condition sanitization on recipient authorization.

1 Introduction

  • A protected value can violate privacy through propagation beyond its initial authorization boundary, without a compromised agent or malicious prompt.The motivating example is an authorized agent forwarding the value to an unauthorized agent during coordination.Source: §1 · p. 1
  • Changing topology changes which recipients can receive an already-disclosed value, even when the task, value, and initial authorization remain unchanged.The effect persists across models and frameworks, while framework choice alone produces a roughly two-orders-of-magnitude leakage spread.Source: §1 · p. 1
  • RECONS uses Detect → Decide → Transform to identify candidate disclosures, check recipient authorization, and transform only unauthorized disclosures when safe transformation is available.It preserves authorized disclosure and falls back conservatively when recipient resolution or safe transformation is unavailable.Source: §1 · p. 2
  • RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, while retaining 94.1% of authorized disclosures; 95.5% of residual cases are detection misses.The remaining cases include recipient-resolution failures and post-transformation detector-positive cases.Source: §1 · p. 2
  • The paper characterizes exposure across coordinator–worker, peer-to-peer, and hierarchical topologies and evaluates RECONS against no sanitization, blanket redaction, and recipient-blind DLP.Its contributions also decompose residual exposure into detection misses, recipient-resolution failures, and post-transformation cases.Source: §1 · p. 2

2 Background and Related Work

Multi-agent workflows create multiple routes for information to move among agents, tools, and shared memory. Prior work examines disclosure, propagation, and defenses, but the reviewed approaches do not condition their central decision on the recipient a value is about to reach.

2.1 Background

  • Agents can share information through tool use, shared memory, and direct messages, so a value disclosed once can reach further participants through system wiring.The paper frames this as a topology-dependent recipient-set problem.Source: §2.1 · p. 2
  • Detection, recipient-authorization decisions, and transformation are distinct capabilities; the paper emphasizes recipient-conditioned decisions and describes LLM-as-judge detection and per-channel transformations.Format-preserving encryption retains plaintext format, metric local differential privacy perturbs values under a privacy budget, and pseudonymization preserves referential consistency without content.Source: §2.1 · p. 2

2.2 Related Work

  • Prior privacy work studies disclosure, new leakage in multi-agent execution, and intervention after detection, but does not make the recipient about to receive a value its central decision condition.The review distinguishes these lines by their focus rather than treating them as a single problem.Source: §2.2 · p. 2

2.2.1 Privacy Leakage in Multi-Agent LLM Systems.

  • Prior multi-agent studies report contextual-judgment failures, compositional or negotiation leakage, and architectural defenses, but do not connect leakage to communication-graph structure and an explicit recipient-authorization relation.The cited work includes model-human agreement falling from 0.8 to 0.1 across complexity tiers, and negotiation leakage up to 56%.Source: §2.2.1 · pp. 2–3

2.2.2 Multi-Agent Leakage Measurement.

  • AgentLeak measures internal-channel leakage under one fixed two-agent topology, while MAMA studies actively probed memory and graph properties rather than benign propagation against recipient authorization.The paper positions its measurement as isolating topology while holding scenario, detector, and policy fixed.Source: §2.2.2 · p. 3

2.2.3 DLP and Privacy-Preserving Transformation.

  • Prior defenses include single-prompt transformation and perimeter controls, whereas this paper targets internal propagation and recipient-aware treatment of values already inside a multi-agent system.The comparison table frames propagation control as acting on where a value is headed, not only whether it is sensitive.Source: §2.2.3 · pp. 3–4, Table 1 · p. 4

2.2.4 Context- and Recipient-Aware Enforcement.

  • Related enforcement work uses adversarial-threat noninterference, prompted judgments, or other context, but the reviewed approaches do not condition control on the topology-dependent recipient for benign disclosures.The paper describes its contribution as extending topology-conditioned propagation measurement and adding an authorization-aware decision layer.Source: §2.2.4 · p. 4

3 Threat Model and Problem Formulation

The section formalizes leakage as unauthorized disclosure to recipients across observable channels and models topology as changing reachable recipients under a passive threat model.

3.1 Observable Channels and Multi-Agent Execution

  • Seven channels capture observable events; only inter-agent messages and shared-memory reads identify recipients in the trace.Events are represented by protected attribute, value type, channel, recipient when resolvable, time, and whether the recipient was original or topology-introduced.Source: §3.1 · p. 4

3.2 Authorization Semantics

  • Authorization is an externally specified allow-or-sanitize relation conditioned on the protected attribute, value type, channel, recipient, and recipient position.A sanitize decision marks an authorization-boundary crossing; the decision layer is evaluated against this relation as an oracle.Source: §3.2 · p. 4

3.3 From Boundary Crossing to Disclosure

  • A boundary crossing becomes disclosure only when an unauthorized recipient observes the protected value; after sanitization, leakage requires that the value remain recoverable.An authorized recipient observing the value is not a violation, and an unauthorized recipient unable to recover it after transformation is a crossing without leakage.Source: §3.3 · pp. 4–5

3.4 Topology Model

  • The six topology cells vary coordination pattern and agent count; CW-2 has no topology-introduced recipients, while every non-reference topology admits them.The scenarios are re-roled without expanding authorization policies, enabling paired within-scenario comparisons.Source: §3.4 · p. 5
  • The design varies wiring at seven agents and varies peer-to-peer scale across four, seven, and ten agents.CW-7 is a star, P2P-7 is fully connected, and Hier-7 has a two-level structure; agent count does not impose a total ordering of complexity.Source: §3.4 · p. 5

3.5 Protected-Value Taxonomy

  • Protected values are grouped by admitted transformation: format-dependent values preserve structure, value-dependent values support pseudonymization or mLDP, and contextual values require semantic rewriting or redaction.The contextual class extends a two-class distinction for sensitive information in free-form agent-to-agent text.Source: §3.5 · p. 5

3.6 Adversary Model

  • The primary adversary passively observes exposed channels without modifying execution; the main threat model excludes inference, collusion, cross-session correlation, and out-of-scope channels.Three levels cover benign execution, an external adversary targeting C1, and an internal adversary targeting C2–C5; stronger capabilities are evaluated separately.Source: §3.6 · p. 5

4 Experimental Methodology

The methodology evaluates paired multi-agent scenarios across controlled topology and adversary conditions, using a tiered disclosure detector whose semantic threshold is calibrated on expert-labeled traces.

4 Experimental Methodology

  • The experiments vary topology, adversary level, protected-value class, channel, and execution horizon, holding Qwen3-32B and LangGraph fixed unless stated otherwise.This isolates topology as the independent variable in the default setup.Source: §4 · p. 5

4.1 Corpus Construction and Evaluation Scale

  • 485 true multi-agent scenarios remain after filtering 1,000 AgentLeak scenarios; each is evaluated in six topology cells and three adversary levels, yielding 8,730 records.Each record contributes 14 channel-and-pair detection instances, for 122,220 total; the corpus spans corporate, finance, healthcare, and legal scenarios.Source: §4.1 · p. 5, Table 3 · p. 6

4.2 Baseline Detection Pipeline

  • Disclosure detection proceeds from exact matching to structured-field recognizers and then an LLM judge for semantic equivalence.Deterministic matches are attributed before judge detections to prevent duplicate counting; the judge uses a calibrated threshold.Source: §4.2 · p. 6

4.3 Detection Stratification

  • A deterministic pre-filter separates certain positives, certain negatives, and semantic-middle instances, which alone are assessed by the Tier-3 judge.Reporting Tier-3 performance only on the semantic-middle stratum avoids conflating semantic judging with exact matching.Source: §4.3 · p. 6

4.4 Calibration Corpus and Ground Truth

  • Two domain experts adjudicated a stratified sample of 300 semantic-middle instances, resolving 299 as 32 leaks and 267 non-leaks.Raw-label agreement was 95.7%, with Cohen’s κ of 0.835 three-way and 0.846 binary.Source: §4.4 · p. 6

4.5 Threshold Calibration

  • At ζ=0.50, the semantic-middle calibration sample yields precision 0.9091, recall 0.9375, FPR 0.0112, and F1 0.9231.The threshold maximizes F1 subject to FPR < 0.05; AgentLeak’s ζ=0.72 yields F1 0.8525 on this sample.Source: §4.5 · p. 6

5 Evaluation

The evaluation distinguishes overall surface leakage from recipient-conditioned exposure and finds that topology shifts where disclosed information reaches more than how often disclosure occurs.

5.1.1 Experimental Design.

  • The exposure measures distinguish scenarios with any unauthorized disclosure from those reaching a topology-introduced recipient or any recipient outside the authorized set.New-agent disclosure is the primary topology-conditioned measure; surface leakage counts scenarios with at least one unauthorized disclosure.Source: §5.1.1 · p. 6, Figure 3 · p. 7, Figure 2 · p. 7

5.1.2 Topology-Conditioned Exposure.

  • New-agent disclosure rises from 0% at CW-2 to 49.9–52.2% at Hier-7, while surface leakage stays between 60.6% and 62.8%.Across P2P cells, new-agent disclosure is 43.1–47.8%; unauthorized propagation ranges from 84.3% at CW-2 to at most 86.0% in richer topologies.Source: §5.1.2 · pp. 6–7, Figure 3 · p. 7, Figure 2 · p. 7
  • Topology effects are larger for new-agent disclosure (χ² = 191.8, df = 4, p = 2×10^-40) than for unauthorized propagation (χ² = 94.2, df = 5, p = 9×10^-19).The repeated-measures Cochran’s Q tests exclude CW-2 from the new-agent topology test because its outcome is structurally zero.Source: §5.1.2 · p. 7, Table 5 · p. 7
  • New-agent disclosure is not strictly monotonic across richer topologies; the reported C2 pathways are consistent with communication structure changing which recipients receive already-disclosed information.At A0, P2P-4 exceeds P2P-7, and the reported disclosures occur through C2 rather than deterministically injected structured channels.Source: §5.1.2 · p. 7

5.2 Compositional Leakage

Disclosure is concentrated early in execution and in confirmation probes, while tool channels add a separate surface; the evaluated reconstruction analyses find no confirmed emergent recovery.

5.2 Compositional Leakage

  • 60.5% of behavioral-channel first-time disclosures occur at T1→T3, and the same front-loaded pattern appears across all channels and tool channels.Cumulative behavioral disclosure rises from 0.020 at T1 to 0.321 at T20, but later turns add relatively few first-time disclosures.Source: §5.2 · p. 7, Table 7 · p. 8
  • Confirmation probes account for 574 of 2,212 disclosing turns (25.9%), compared with 0.9%–2.7% for other archetypes.They are the dominant, but not exclusive, disclosure context; 14.7% of first-time disclosures occur in other turn types.Source: §5.2 · p. 7, Table 8 · p. 8
  • Mean T20 tool-channel disclosure is 0.089 versus 0.321 behaviorally, and 55 of 86 first-time tool disclosures occur at T1→T3.Tool-channel disclosures make tool-call arguments and memory writes a distinct audit surface beyond behavioral channels.Source: §5.2 · p. 8

5.3 Reconstruction: No Confirmed Emergent Recovery

  • No confirmed reconstruction occurred from single-channel inference, cross-channel evidence, or pooled cross-agent views in the evaluated corpus and protocol.The evaluation covered 2,954 inference instances, 3,195 cross-channel pairs, and 172,949 cross-agent pairs; all raw positives were rejected on audit.Source: §5.3 · p. 8, Table 9 · p. 8
  • The reported T5 distinguishability signal does not survive the confound analysis.First-time direct disclosures were front-loaded; this timing result is distinct from reconstruction.Source: Table 10 · p. 8, §5.3 · p. 8

5.4 Behavioral Leakage

Behavioral analyses find that apparent distinguishability is transient and confounded, while evaluated leakage is primarily direct disclosure followed by propagation across agents, channels, and turns.

5.4 Behavioral Leakage

  • The analysis tested whether protected values affected 33 behavioral features using matched pairs without judge-confirmed disclosure on either trajectory.A logistic-regression distinguisher used scenario-grouped cross-validation; a definitive test would require randomized generation order or repeated generations per scenario.Source: §5.4 · p. 8, §5.4.1 · pp. 8–9

5.4.1 Pair Distinguishability.

  • At T5, behavioral distinguishability reached 56.6%, but generation order was perfectly confounded with pair labels, so the signal was not treated as behavioral leakage.The advantage was near-random at T1 (50.2%) and T20 (50.0%).Source: §5.4.1 · pp. 8–9

5.5 Synthesis: Leakage Is Primarily Direct and Propagative.

  • Zero confirmed emergent recovery across 179,098 evaluated instances and pairs supports direct disclosure followed by propagation as the dominant leakage pathway.Richer topology expands the recipient set for already-disclosed values, and longer executions add disclosure opportunities.Source: §5.5 · p. 9

5.6 Cross-Framework Leakage Measurement

Across eight orchestration frameworks, leakage separated into high- and low-leakage groups, while channel-level, value-fidelity, and robustness analyses qualify how those rates should be interpreted.

5.6.1 Experimental Design.

  • The comparison used 7,760 executions of 485 scenarios across eight frameworks, with the same Qwen3-32B generator, prompts, tools, and attribute assignments.Each framework used its native coordination abstraction, and 214,853 channel events were normalized into a common trace schema.Source: §5.6 · p. 9, §5.6.1 · p. 9

5.6.2 Detection and Authorization.

  • The frozen detection pipeline first identified semantic attribute disclosures; policy filtering then excluded disclosures explicitly authorized by each scenario.The policy-filtered measure represents contextual-integrity violations in the comparisons.Source: §5.6.2 · p. 9

5.6.3 Value Fidelity Verification.

  • Value fidelity was measured independently by comparing canonicalized generated identifiers and other attributes against ground truth as exact, corrupted, or substituted.This check was used to determine whether framework rankings could be explained by confabulation.Source: §5.6.3 · p. 9

5.6.4 Framework Leakage Rates.

  • 43.38% for AutoGen versus 0.29% for Google ADK yielded an approximately 150× spread, with four frameworks in each high- and low-leakage group.The low-group frameworks were statistically tied; the high-group internal gaps exceeded the reported noise floor.Source: §5.6.4 · p. 9, Table 12 · p. 9
  • Tool inputs and outputs had the highest leakage rates, followed by artifacts, inter-agent communication, and shared memory; user-facing outputs had substantially fewer disclosures.Evaluating only final responses therefore understates MALS privacy exposure.Source: §5.6.4 · p. 9, Figure 4 · p. 10

5.6.5 Value Fidelity Is Independent of Leakage.

  • Leakage frequency and value fidelity diverged: AutoGen leaked most frequently with 87.15% accurate reproductions, while LlamaIndex leaked rarely and correctly reproduced only 36.23% of verifiable cases.The framework grouping persisted when analysis was restricted to exact-value disclosures, so confabulation did not explain the separation.Source: §5.6.5 · pp. 9–10

5.6.6 Robustness Across Generation Regimes.

  • Across unseeded corpora at temperatures 0.2, 0.5, and 0.7, high- and low-leakage groups stayed more than 19.8 points apart, with no framework changing group membership.Maximum per-framework drift from the temperature-0.0 anchor was 0.39pp, 0.21pp, and 0.41pp at temperatures 0.2, 0.5, and 0.7, respectively.Source: §5.6.6 · p. 10

5.7 Model Generalization

The topology-induced exposure pattern appeared across four generators, but both its magnitude and cell ordering varied, and residual propagation differed by attribute type.

5.7.1 Topology-induced exposure generalizes, but its magnitude

  • Every richer topology cell showed topology-induced exposure across all four generators, while CW-2 showed none; richer-cell rates ranged from 9.3% to 65.8%.The smallest richer-cell rate remained separated from CW-2's confidence bound, but cell ordering varied across generators.Source: §5.7.1 · p. 10, Figure 5 · p. 11

5.7.2 Model behavior contributes to exposure variation.

  • Manual checks found no missed topology-introduced disclosures in sampled Gemini Hier-7 runs, while residual propagation varied sharply by attribute type.Structured identifiers propagated at 0.0–3.7%, compared with 27.6% for confidential strategy, 36.4% for internal notes, and 63.6% for criminal history.Source: §5.7.2 · p. 11

5.7.3 Implications for Topology-Aware Privacy Enforcement.

  • Because exposure varies across both generators and attribute types, the authors evaluate RECONS using realized recipients and execution context rather than topology or generator assumptions alone.The sweep held framework, corpus, topology, pipeline, and detector fixed while varying the generator.Source: §5.7 · p. 10, §5.7.3 · p. 11

5.8 Framework Generalization

Topology-introduced exposure occurred in richer cells across LangGraph and AutoGen, but rates differed by framework and by the realized path information followed.

5.8.1 Cross-Framework Replication.

  • Richer topology cells showed exposure in both frameworks, but AutoGen rates were 20.2–37.5% and LangGraph rates were 35.3–49.9%, with different peak cells.LangGraph peaked at Hier-7 (49.9%); AutoGen peaked in P2P cells (37.5%).Source: §5.8.1 · p. 11, Figure 6 · p. 11

5.8.2 Realized-Path Analysis.

  • In Hier-7, exposure was 34.0% for AutoGen direct-access executions versus 2.8% relay-required, compared with 55.9% versus 60.3% for LangGraph.The hop analysis was conditional on a defined disclosing agent: 485 AutoGen and 423 LangGraph executions.Source: §5.8.2 · pp. 11–12, Table 14 · p. 12

5.8.3 Evidence for a Relay-Semantic Explanation.

  • AutoGen relay failures occurred in multi-hop CW-7 and Hier-7 at 12.2% and 8.5%, respectively, while P2P cells requiring no relay showed 0%.The results are consistent with differing relay semantics, but do not establish message reproduction or shared-state execution as the sole cause.Source: §5.8.3 · p. 12, Table 15 · p. 12

5.8.4 Implication for Topology-Aware Privacy Enforcement.

  • Because realized propagation depends on how orchestration preserves information along paths, the paper conditions sanitization on recipient and observable execution context.The authors caution that nominal topology, agent count, or edge count alone cannot characterize exposure.Source: §5.8.4 · p. 12

6 RECONS: Recipient-Conditioned Sanitization

This section examines RECONS, which conditions sanitization on the recipient and workflow context, transforming unauthorized values while preserving authorized disclosures. It evaluates leakage reduction and disclosure retention, alongside limitations in detection coverage and recipient resolution and the role of an exact-match verification backstop.

6 RECONS: Recipient-Conditioned Sanitization; 6.1 Positioning; 6.2 Architecture

  • RECONS uses a Detect–Decide–Transform pipeline that checks recipient authorization and context before applying a type-appropriate transformation to unauthorized values.It operates inline on agent-authored events so transformed content can continue through later workflow steps; the transformation choices include FPE, pseudonymization or mLDP, contextual rewriting, and redaction fallback. The evaluation primarily observed direct and propagative leakage, not successful reconstructive or behavioral side-channel leakage.Source: §6.1 · p. 12, §6 · p. 12, §6.2 · p. 13

6.3.3 Results: Detection Varies by Value Type; 6.3.4 Channel Dependence; 6.3.5 Precision and Tuning; 6.3.6 Carried-Forward Limitations

  • Pre-tuning recall was 85.0% for value-sensitive, 65.1% for format-sensitive, and 36.0% for context-sensitive values.The Tier-3 judge identified 39 of 40 sampled positives with no false positives on 20 controls; these samples do not establish population-level performance. Tuning raised overall recall from 62.9% to 66.7% and format-sensitive recall from 65.1% to 73.0%, with local-phone recall rising from 19.6% to 99.3%; format-sensitive recall was also lower on C3 (39.2%) and C5 memory writes (40.5%) than on C2 (85.3%) and C6 (83.7%).Source: §6.3.3 · p. 13, §6.3.4 · p. 14, §6.3.5 · p. 14

6.4.3 Decision-Layer Validation; 6.4.4 Topology-Position Extension; 6.6.4 Ablation Analysis

  • Among 2,092 occurrences requiring sanitization, Static-A allowed 50 (2.39%) to pass, while Dynamic-A allowed none.Neither policy over-sanitized the 17 should-allow cases. Unrestricted graph reachability would have reclassified 14 of those 17 as requiring sanitization; replacing recipient-aware authorization with static authorization raised residual leakage from 29.25% to 29.81% and correct-allow from 94.1% to 100%.Source: §6.4.3 · p. 14, Table 18 · p. 15, §6.4.4 · p. 15

6.5.2 Mechanism Verification; 6.6.4 Ablation Analysis

  • On a 103-occurrence development sample, all transformed occurrences achieved 100% detector-based P-removal.Of 35 rewriting decisions, 27 passed on the first attempt and 8 fell back to redaction after three attempts; this is detector-based verification, not proof of semantic non-disclosure. Replacing the transformation menu with uniform redaction changed residual leakage from 29.25% to 29.59%, with correct-allow unchanged at 94.1%.Source: §6.5.2 · p. 15, Table 19 · p. 16, §6.6.4 · p. 17

6.6 RECONS Evaluation

  • 29.25% residual leakage (vs. 96.7% without sanitization) and 94.1% correct-allow (vs. 20.5% for blanket redaction) were RECONS’s held-out results.Presidio recorded 35.5% residual leakage and 34.7% correct-allow. RECONS’s aggregate leakage difference from blanket redaction concentrates in the 10 scenarios with legitimately disclosable fields.Source: Table 20 · p. 16, §6.6 · p. 16

6.6.1 Sources of Residual Leakage

  • 95.5% of RECONS’s 10,116 residual cases were undetected values, while 4.5% were detected values without a resolvable recipient.Detection coverage was 69.2% of held-out should-sanitize occurrences; seven residual cases were sanitizer-acted content still flagged by the evaluation detector, not confirmed disclosures. Contextual values had 55.7% residual leakage, versus 17.6% for value-dependent and 23.3% for format-dependent values.Source: Table 21 · p. 16, §6.6.1 · p. 16, Table 22 · p. 16

6.6.2 Channel-Level Disclosure; 6.6.3 Topology Gradient Under Sanitization

  • Across five richer topologies, unsanitized disclosure to topology-introduced agents was 97.6–98.0%, versus 25.1–26.9% with RECONS.RECONS beat blanket redaction in four of five non-trivial topology cells and tied in Hier-7. By channel, C3 had the highest residual leakage; RECONS matched or improved on blanket redaction only on C1 and C2.Source: §6.6.2 · pp. 16–17, Table 23 · p. 17, §6.6.3 · p. 17

6.6.5 Utility and Evaluation Limitations.

  • 99.3% was the meaning-preservation proxy score for blanket redaction versus 83.5% for RECONS, but the proxy does not establish greater practical utility.RECONS scored 91.6% for format-dependent and 89.6% for value-dependent values; the authors identify correct-allow as the primary retention measure because it reflects ground-truth authorization labels.Source: Table 24 · p. 17, §6.6.5 · p. 17

6.6.4 Ablation Analysis.

  • 89.6% fewer post-transformation detector-positive cases remained after adding an exact-match backstop, with none indicating literal reintroduction bypassing it.The seven remaining cases involved negated true values or disagreement between judge calls; the result establishes performance under this instrument, not immunity to semantic or inferential leakage.Source: §6.6.4 · p. 17

6.6.5 Utility and Evaluation Limitations.

  • Recipient-aware sanitization approaches blanket redaction’s residual-leakage performance while substantially increasing authorized-disclosure retention; detection coverage, especially for contextual values, and recipient resolution remain limitations.Source: §6.6.5 · p. 17

7 Discussion and Limitations

The discussion treats topology as a security-relevant configuration because it changes which recipients protected values reach, and argues that enforcement should follow realized recipient and execution paths. RECONS’s selective retention remains bounded by detection coverage, recipient resolution, and the evaluated threat model.

7.1 Design Implications

  • Across six cells, topology-introduced recipient disclosure rises from 0% to 52.2%, while surface leakage varies by only 2.2 points.The discussion says richer topology creates exposure that a simpler topology structurally cannot, but makes no universal claim about which richer topology is riskiest.Source: §7.1 · p. 18
  • RECONS retains 94.1% of authorized disclosures versus 20.5% for blanket redaction, while residual disclosure is 29.25% versus 28.3%, respectively.The comparison rests on 303 should-allow occurrences, with the retention gap concentrated in 10 of 405 scenarios containing a legitimately disclosable field.Source: §7.1 · p. 18
  • Unflagged disclosures account for 95.5% of end-to-end residual leakage, which neither RECONS nor blanket redaction can address without improved detection.An undetected value never reaches the decision layer and passes through regardless of transformation sophistication.Source: §7.1 · p. 18
  • For C3 tool-call arguments, 95.8% are self-loops and 4.2% reach another agent via covered C5 reads; extending resolution needs richer consumer provenance.Without that provenance, attribution to the agent that next acts on a tool’s output would invent a recipient not evidenced by the trace.Source: §7.1 · p. 18
  • Horizon coverage confounds cross-domain comparisons: 105 scenarios lack a common horizon, finance and healthcare are almost entirely T1, and legal is mostly T3 or longer.The discussion cautions against reading these as horizon-controlled domain estimates.Source: §7.1 · p. 18

7.2 Threat-Model Limitations

  • Evaluation uses an English-language, four-domain subset of one public benchmark [30], with generalization checks on only a handful of additional systems.Those checks support that findings are not artifacts of one system, but do not establish generalization beyond the tested systems.Source: §7.2 · p. 18
  • Latent-state leakage, stronger collusion, cross-session inference, and channels beyond the seven instrumented channels fall outside the trace-based evaluation scope.The threat model also does not establish absence of reconstruction from indirect evidence or behavioral side channels under a more capable or adaptive adversary.Source: §7.2 · p. 18

8 Conclusion

Topology changes where protected values reach, while surface leakage changes little; RECONS reduces residual disclosure while retaining authorized disclosures. Detection misses remain the main constraint, and enforcement must account for recipients and communication paths realized at runtime.

8 Conclusion

  • Topology-introduced recipient exposure rises from 0% to 52.2% while surface leakage moves only 2.2 points, and framework choice independently produces a two-orders-of-magnitude spread.The topology effect holds across additional models and frameworks; exhaustive tests found no confirmed leakage beyond direct disclosure and its propagation.Source: §8 · p. 18
  • RECONS reduces residual disclosure to 29.25% versus 28.3% under blanket redaction while retaining 94.1% of authorized disclosures versus 20.5%.The approach conditions enforcement on the recipient rather than sensitivity alone.Source: §8 · p. 19
  • 95.5% of residual cases are detection misses and 4.5% trace to RECONS’s recipient-resolution step, making detection coverage the binding constraint.The conclusion calls for controls to act on the recipient and communication path realized at runtime, not static topology, framework, or model assumptions.Source: §8 · p. 19

A Appendix

The appendix includes interaction archetypes used to construct trajectories and disclosure rates by protected-attribute type for Gemini-3.7-Flash Hier-7.

A Appendix

  • Table 25 lists interaction archetypes used in trajectory construction.Source: Table 25 · p. 20
  • Table 26 reports Gemini-3.7-Flash Hier-7 disclosure rates by protected-attribute type, with structured identifiers showing lower observed rates than contextual and narrative attributes.Source: Table 26 · p. 20

Related papers

Loading 2610.16039v1…