Paper deep dive
When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
Sunday Oyinlola Ogundoyin, Muhammad Ikram
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to one authorized agent can propagate through routine coordination to an unauthorized one, without compromise or malicious behavior. This motivates topology-aware enforcement that blocks unauthorized propagation while preserving authorized disclosure. We evaluate 485 scenarios across coordinator-worker, peer-to-peer, and hierarchical topologies, instrumenting seven communication channels and measuring surface leakage and disclosure to topology-introduced recipients. We introduce RECONS, a Detect -> Decide -> Transform sanitizer conditioning intervention on recipient and execution context rather than sensitivity alone. Topology changes where protected information propagates, with disclosure to topology-introduced recipients rising from 0% to 52.2% while surface leakage stays nearly flat at 60.6-62.8%. This effect persists across four generator models and a second orchestration framework, though magnitude and relay paths differ; framework choice separately drives a 150x leakage spread, so topology alone is not sufficient. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction. Detection coverage is the dominant bottleneck, accounting for 95.5% of residual disclosures. These results show that privacy enforcement in MALS must reason about the recipient and communication path realized at runtime, not sensitivity or topology assumptions alone.
Tags
Links
- Source: https://arxiv.org/abs/2610.16039v1
- Canonical: https://arxiv.org/abs/2610.16039v1
Trouble viewing inline? Open PDF directly →
Full Text
120,274 characters extracted from source content.
Expand or collapse full text
When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems Sunday Oyinlola Ogundoyin sunday.ogundoyin@hdr.mq.edu.au Macquarie University Sydney, NSW, Australia Muhammad Ikram Macquarie University Sydney, NSW, Australia muhammad.ikram@mq.edu.au Abstract Multi-agent LLM systems (MALS) introduce a privacy-leakage prob- lem that conventional sensitivity-based defenses miss, since infor- mation disclosed to one authorized agent can propagate through routine coordination to an unauthorized one, without compromise or malicious behavior. This motivates topology-aware enforcement that blocks unauthorized propagation while preserving authorized disclosure. We evaluate 485 scenarios across coordinator-worker, peer-to-peer, and hierarchical topologies, instrumenting seven com- munication channels and measuring surface leakage and disclosure to topology-introduced recipients. We introduce RECONS, a Detect →Decide→Transform sanitizer conditioning intervention on recip- ient and execution context rather than sensitivity alone. Topology changes where protected information propagates, with disclosure to topology-introduced recipients rising from 0% to 52.2% while surface leakage stays nearly flat at 60.6–62.8%. This effect persists across four generator models and a second orchestration frame- work, though magnitude and relay paths differ; framework choice separately drives a 150× leakage spread, so topology alone is not sufficient. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, preserving 94.1% of authorized disclosures versus 20.5% under blanket redaction. Detection coverage is the dominant bottleneck, accounting for 95.5% of residual disclosures. These results show that privacy enforcement in MALS must reason about the recipient and communication path realized at runtime, not sensitivity or topology assumptions alone. 1 Introduction Large Language Model (LLM) applications are evolving from single- agent interactions into multi-agent systems in which specialized agents collaborate to complete task [26,33]. One agent may plan a task, another may retrieve information or invoke a tool, and others may coordinate, maintain state, or produce intermediate artifacts. This decomposition improves modularity and capability, but it also changes the security model for LLM applications. Information is no longer exchanged only between a user and one model; it can propagate across multiple agents and execution channels before the system produces its final response. This turns collaboration in multi- agent LLM systems (MALS) into an information-flow problem [4, 7], in which sensitive-data leakage occurs not because a value is disclosed, but because it reaches the wrong recipient. Consider a user푢discloses a protected value푣to agent퐴, who is authorized to receive it; coordinating with퐵to complete the task,퐴forwards푣 to퐵, who is not authorized to receive it. No agent is compromised, and no malicious prompt is required. The violation arises not from the initial disclosure but from its propagation past the authorization boundary. This differs from prior treatments of multi-agent leakage in three ways. First, exposure changes with topology. Adding an agent adds a new party the value can reach, and a value confined to a two-agent exchange may be forwarded to an agent that exists only because the system grew richer. AgentLeak [30] measures internal-channel leak- age under one fixed two-agent topology and does not vary it. Liu et al. [18] show topology affects leakage magnitude, but under an adversary actively probing memory, not benign execution with an authorization relation over recipients. Neither establishes whether a legitimate disclosure becomes unauthorized solely through coor- dination structure. Second, a defense treating every detected value alike cannot distinguish these cases; it must sanitize everything, destroying legitimate disclosures, or sanitize nothing, permitting unauthorized ones. Third, most existing sanitizers do not decide whom a value may reach. Preempt [6] transforms a value once judged sensitive, but for one user and one model owner, with no second, differently authorized recipient to condition on. Reasoning- based mitigations [16,28] improve how an agent judges disclosure, but the judgment remains the model’s own about a single mes- sage, not a policy conditioned on where it is forwarded. FIDES [7] enforces provable guarantees over execution traces, but targets adversarial prompt injection, not benign over-disclosure. All treat sensitivity and authorization as one question—but they are two. We refer to this as topology-conditioned recipient exposure: a coordinator–worker (CW), a peer-to-peer (P2P), and a hierarchical (Hier) system expose different recipient sets, so changing topology changes where an already-disclosed value propagates even when task, value, and initial authorization are unchanged. Richer topology need not monotonically increase leakage; it changes the recipient set against which authorization is evaluated. This motivates measur- ing how information propagates across communication structures and enforcing privacy selectively at recipient boundaries. This pa- per answers three questions. •RQ1: How does topology affect propagation to unauthorized recipients, and does this hold across frameworks and models? •RQ2: Does recipient-conditioned enforcement reduce unautho- rized disclosure while preserving authorized disclosure? • RQ3: What accounts for residual exposure after sanitization? For RQ1, we instantiate the same scenarios across CW, P2P, and Hier topologies, measuring both disclosure and whether it reaches an unauthorized recipient. Topology changes propagation and exposes values to topology-introduced recipients, persisting across models and frameworks, though magnitude and ordering depend on execution semantics. Holding topology fixed, framework choice alone produces a leakage spread of roughly two orders of magnitude; topology is thus security-relevant but not a sufficient predictor on its own. arXiv:2610.16039v1 [cs.CR] 12 Oct 2026 Sunday et al. RQ1 gives the second distinction a concrete mechanism: topology is how a value authorized for one recipient reaches another it never was, which motivates RQ2. If a detected value푣is authorized for the recipient, transforming it destroys legitimate information; if unauthorized, passing it through permits the violation. Recipient- blind enforcement must choose: blanket redaction over-suppresses, pass-through under-protects. The missing decision is not whether푣 is sensitive, but whether this recipient may receive푣here. We address this with RECONS, an inline, recipient-conditioned mechanism. A value should be transformed when about to cross an authorization boundary to an unauthorized recipient, not merely because it is sensitive. RECONS separates enforcement into Detect→Decide →Transform: detection identifies candidates, decision evaluates recipient authorization, and transformation intervenes only when disclosure is unauthorized, preserving authorized disclosure and falling back conservatively when resolution or safe transformation is unavailable. Compared to no sanitization, blanket redaction, and recipient- blind DLP, RECONS reduces residual disclosure from 96.7% to 29.25% (28.3% blanket, 35.5% Presidio) while retaining 94.1% of authorized disclosures, roughly 4.6×blanket redaction’s. This also answers RQ3: 95.5% of residual cases are detection misses, a ceil- ing any same-detector sanitizer would share; 4.5% are recipient- unresolvable, specific to RECONS’s own resolution step; seven remain post-transformation detector-positive. Privacy enforcement in MALS must therefore account for where information is routed, not only what it is: topology determines reachable recipients, autho- rization determines permitted disclosures, and an effective control decides at the communication boundary. This paper makes the following contributions: (1)Topology- and architecture-conditioned recipient- exposure characterization. We characterize protected-value propagation across CW, P2P, and Hier topologies and replicate it across generator models and frameworks. We show that topology and framework choice independently drive recip- ient exposure, with framework alone producing a roughly two-order-of-magnitude spread. (2)Recipient-conditioned privacy enforcement. We introduce RECONS, an inline sanitizer implemented as a Detect→De- cide→Transform pipeline that conditions enforcement on recipient identity and authorization context whenever observ- able. (3)Controlled privacy–authorization evaluation. We evalu- ate RECONS against no sanitization, blanket redaction, and recipient-blind DLP under a frozen evaluation protocol. RE- CONS approaches blanket redaction’s residual-leakage per- formance while preserving substantially more authorization- permitted disclosures. (4) Residual-exposure decomposition. We distinguish detection misses, recipient-resolution failures, and post-transformation residual cases, identifying detection coverage, a limitation any downstream sanitizer would share, as the dominant bottleneck, and recipient resolution as a limitation specific to this architec- ture. Figure 1 summarizes the resulting pipeline, from corpus and topol- ogy configuration through framework- and model-level execution to detection and RECONS-based evaluation. 2 Background and Related Work 2.1 Background A multi-agent LLM system decomposes a task across multiple LLM- driven agents coordinated by a framework (e.g., LangChain [14], AutoGen [29], LangGraph [15]) in a CW, P2P, or Hier arrange- ment; production frameworks typically support more than one. This decomposition means an agent’s action is not confined to a single request-response exchange: it can invoke tools, read and write shared memory, and message other agents directly, each a point where information available to one agent becomes available elsewhere. So, a value disclosed once can reach further participants purely because of how the system is wired, independent of whether that disclosure was itself appropriate, the property our threat model (§3) formalizes as observable channels and a topology-dependent recipient set. Addressing this exposure requires three capabilities: detecting disclosure, deciding whether the resolved recipient is authorized, and transforming an unauthorized value without destroying its utility for authorized ones. Detection and transformation draw on existing techniques; deciding based on the recipient rather than sensitivity alone is the focus of our mechanism, introduced in §6.4. LLM-as-judge detection scores semantic equivalence between a can- didate span and a protected value using a separate, calibrated model, catching paraphrase-based disclosure that pattern matching cannot, once its threshold is calibrated against labeled examples (§6.3). Once a value is detected and unauthorized, format-preserving encryption (FPE) keeps its ciphertext in the plaintext’s format, letting it pass through downstream logic built for that format, at the cost of a min- imum domain size. Metric local differential privacy (mLDP) instead perturbs a value under a privacy budget휀for approximate utility, while pseudonymization substitutes a deterministic, keyed value preserving referential consistency but no content. Preempt [6] ap- plies FPE and metric-LDP for a single user, and our transformation layer (§6.5) applies both per-channel, conditioned on the recipient. 2.2 Related Work Privacy in MALS has been studied along three separate lines: whether agents disclose sensitive information, whether multi-agent execution creates new leakage, and how defenses should intervene once a value is detected, but none conditions its central decision on who the value is about to reach. 2.2.1 Privacy Leakage in Multi-Agent LLM Systems. Some work investigates whether an agent judges disclosure correctly. CON- FAIDE [21] evaluates contextual-integrity reasoning directly and finds model-human agreement on appropriate information flow drops from 0.8 to 0.1 across four tiers of complexity. Privacy- Checker [28] reports the same failure as a judgment-action gap, where models identify sensitive content correctly 98% of the time yet leak it in roughly a third of interactions, and its live benchmark, PrivacyLens-Live, shows higher leakage than static single-turn eval- uation. 1-2-3-Check [16] reduces leakage by decomposing privacy reasoning into extraction, checking, and execution agents. All three treat disclosure as a decision the acting model makes about a sin- gle message; none conditions it on where the message propagates afterward. When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems 1 Corpus & Design 485 multi-agent scenarios (138 corporate, 100 finance, 100 healthcare, 147 legal) Neighboring pair () differ only in Adversary Horizons Authorization & Value Policy allowed_set, forbidden_fields format/value/contextual Authorization policy Topology Specification CW-2 CW-7Hier-7 P2P-4 P2P-7 P2P-10 Phase 1 CONFIGURATION Generator & Tool Configuration Primary: Qwen3-32B via vLLM Model Sweep: GPT-5-mini, Gemini-3.7-Flash, Llama-3.3-70B Deterministic tool layer for and Phase 2 EXECUTION & INSTRUMENTATION Google ADK AutoGen Experiment Matrix FRAMEWORK SWEEP CrewAI LangGraph LangChainLlamaIndex OpenAI Agent SDKSemantic Kernel Qwen3-32B | GPT-5-mini | Gemini-3.7-Flash | Llama-3.3-70B Common corpus, policy, tools Frozen detector for controlled comparisons MODEL SWEEP Runner & Orchestration Same Scenario executed under each framework & topology Framework-agnostic Adapter Framework hooks Trace capture normalized to JSONL Common event schema CW | P2P | Hier Agent roles + edges Execution graph Information-flow graph Orchestration Runtime Agent Runtime Agent-authored events : inter-agent messaging : shared memory reads/writes Memory / Artifacts : shared memory : persistent artifacts : no resolvable recipient Field-level Channels Tools / APIs : tool argument API : tool results API User-facing Outputs : final output : visible reasoning / execution logs : messages : memory reads resolvable recipient Recipient-aware Channels DETECT Identifies candidate protected values DECIDE Resolves recipient, checks authorization TRANSFORM FPE, mLDP, pseudonym- ization, rewriting, redaction fallback AUTHORIZED ALLOW UNAUTHORIZED TRANSFORM recipient + execution context Phase 3 EVALUATION & ANALYSIS UNIFIED TRACE STORE JSONL Normalized events + execution graph + information-flow-graph Observable Execution Channels RECONS Pipeline Tier 1: Exact/canary matching Tier 2: Structured-field matching Tier 3: LLM-as-judge Three-tier Detector Topology & Path Analysis Surface leakage | New-agent disclosure | Unauthorized propagation Realized graph + recipient distance Topology vs. framework effects RECONS Evaluation Sanitization Effectiveness Residual leakage | Correct-allow Authorization decision accuracy Utility-privacy tradeoff Residual-source decomposition Generalization, Metrics & Reporting Surface leakage Generalization across models and topologies Comparative analysis across frameworks Unified metrics and visualizations Figure 1: Overview of the experimental pipeline: configuration (corpus, topology, and authorization policy), execution (framework and model sweeps), and evaluation (detection, RECONS sanitization, and cross-condition analysis). Other work shows leakage is not confined to what one agent discloses. Patil et al. [22] formalize compositional leakage: an ad- versary aggregating benign responses from multiple agents re- constructs attributes no single agent stated, and show chain-of- thought prompting blocks only 31–39% of such reconstructions. Asif and Amiri [4] derive an information-theoretic bound with the same result. Biswas et al. [5] quantify leakage with a combined mutual-information, Bayesian-inference-gain, and Rényi-DP frame- work. They showed that leakage increases with topology depth and collusion. MAGPIE [12] finds leakage up to 56% in negotiation even under explicit no-disclosure instructions. GAMA [31] and SRPG [11] respond architecturally, isolating raw data in a private workspace or reconstructing sanitized content. However, none ties leakage magnitude to communication-graph structure or an explicit recipient-authorization relation, the two properties central to our threat model. 2.2.2 Multi-Agent Leakage Measurement. AgentLeak [30] shows inter-agent messages and shared memory leak the protected at- tribute at 2.1×the external output’s rate, output-only auditing misses 41.7% of violations, and blanket redaction drops task success by 30–65 points. However, its evaluation uses one fixed two-agent topology. The authors established that internal channels leak, but not how communication structure affects where a disclosed value subsequently reaches. Liu et al. present MAMA [18], showing that denser, more cen- tralized topologies and shorter attacker-target distance increase PII memory leakage across six graphs, the closest prior evidence that topology affects multi-agent privacy. Two differences remain: MAMA’s threat model actively seeds and extracts memory over repeated probing, while we measure organic propagation during benign execution; and MAMA reports leakage as a function of graph distance and centrality, while we define it relative to an au- thorization relation over (value, recipient, channel) triples. So the question is not whether a value reaches a farther node but whether that node was authorized to receive it. Biswas et al.’s topology- depth finding [5] is consistent from an information-theoretic angle but, like MAMA, is not tied to an authorization boundary or a recipient-conditioned defense. AgentBench [19] and AgentDojo [9] evaluate task competence and prompt-injection robustness, not internal-channel exposure. OPENAGENTSAFETY [27] evaluates privacy alongside other harms in a static benchmark, not a topology- conditioned measurement. To our knowledge, no prior measure- ment work isolates topology as an independent variable while holding scenario, detector, and policy fixed, as our RQ1 requires. 2.2.3 DLP and Privacy-Preserving Transformation. Pr∈mpt [6] sanitizes a single prompt with FPE for format-dependent tokens and mLDP for value-dependent ones, with a formal indistinguisha- bility guarantee, but for one outbound prompt and its response, with no second, differently authorized recipient. RECONS reuses these mechanisms per channel but adds a recipient-aware deci- sion layer that Pr∈mpt’s single-agent setting does not require: not only how to transform a protected value, but whether a given recipient requires it transformed at all. Multi-Agent Firewall [8] Sunday et al. Table 1: Comparison with the closest prior measurement and de- fense work. A benign threat model measures organic propagation; propagation control means the mechanism acts on where a value is headed, not only whether it is sensitive. Topology Recipient- Benign threat Propagation variedconditionedmodelcontrol AgentLeak [30]✗✓✗ MAMA [18]✓✗ Biswas et al. [5]✓✗ PrivacyChecker [28]✗ † ✓✗ 1-2-3-Check [16]✗✓✗ FIDES [7]✗✓ ‡ Preempt [6]✗✓✗ This paper✓ † Reasons over sender/recipient/subject but enforces via the acting model’s own prompted judgment. ‡ Controls propagation via label noninterference under an adver- sarial prompt-injection threat model. intercepts outbound traffic with deterministic and NER-based detec- tors before a third-party provider, while AgentGuard [20] enforces attribute-based access control on tool calls; both decide whether content crosses a perimeter, not how a value already inside a multi- agent system should be treated differently by an internal recipient. Our sanitizer targets that internal gap, motivated by AgentLeak’s finding that internal channels leak at 2.1× the external rate. 2.2.4 Context- and Recipient-Aware Enforcement. FIDES [7] enforces noninterference via dynamic label propagation, blocking all policy violations on AgentDojo [9] with fewer task losses than naive taint tracking, but targets an adversarial threat (indirect prompt injection). We study benign disclosure, defining authoriza- tion over observable triples rather than label lattices, trading formal guarantees for applicability to black-box traces. Sentinel [10] monitors a shared conversational space and quarantines violations, but is only a proof-of-concept study without an authorization taxonomy or utility trade-off. PrivacyChecker’s sender, recipient, subject, and transmission principle is the closest reasoning-based analog. Still, judgment is made by prompting the acting model itself, inheriting the judgment-action gap it was meant to diagnose rather than using a frozen decision layer. Ling et al. [17] find that persistent-state and propagation threats remain underserved relative to prompt-injection and tool-hijacking, the imbalance this paper corrects. Table 1 summarizes the comparison. AgentLeak shows internal channels leak and redaction is costly under one fixed topology; MAMA and Biswas et al. show topology affects leakage magnitude under adversarial extraction, without recipient authorization. Pri- vacyChecker, 1-2-3-Check, and FIDES condition enforcement on some context, sender or recipient judgment, decomposed reason- ing, or label flow, but none on the topology-dependent recipient for benign disclosures. Preempt and the DLP systems in §2.2.3 provide transformation and perimeter enforcement, not internal propaga- tion control. This paper extends topology-conditioned propagation beyond AgentLeak’s single topology and adds the authorization- aware decision layer that single-agent and perimeter systems lack. 3 Threat Model and Problem Formulation 3.1 Observable Channels and Multi-Agent Execution We investigate privacy leakage in MALS as it manifests on ob- servable channels, points where information leaves an agent’s pri- vate context and becomes available to other entities. Following AgentLeak [30], we consider seven channels, complete for our threat model: C1, final output to the user; C2, inter-agent mes- saging; C3 and C4, arguments supplied to a tool call and the result returned; C5, shared memory reads and writes; C6, visible reason- ing and execution logs; and C7, artifacts the system produces. These differ in how a protected value is represented, which determines what a detector can act on. C1, C2, and C6 are free-text, where values appear embedded in prose, often paraphrased rather than quoted, since a delegation message retells its originating task in the model’s own words. C3 and C5 are structured, placing a value in a discrete typed field, while C4 and C7 are mixed. Only C2 and C5 reads additionally carry an addressee that the trace identifies; the rest expose a value without naming a recipient, which later bounds recipient-aware enforcement (§6.4). We represent a single observable event as a tuple휗 푡 = ( ̆ 푎,휍,푐,푟,pos,푡), where ̆ 푎is the protected attribute,휍its value type (§3.5),푐 ∈ C1, . . ., C7the channel,푟the recipient when resolv- able,푡the temporal index, andpos ∈ pos 푖 ,pos 푗 records whether 푟is one of the scenario’s original, presumed-authorized agents or an agent the topology introduces (§3.4). 3.2 Authorization Semantics Whether an occurrence of ̆ 푎on channel푐is a violation depends not only on sensitivity but on who receives it. We formalize this as an authorization relationA( ̆ 푎,휍,푐,푟,pos) ∈ allow, sanitize, an externally specified ground-truth relation derived from each sce- nario’s own role and access-control definitions. RECONS’s decision layer (§6) is evaluated againstAas an oracle; an occurrence with A(·)= sanitize is an authorization-boundary crossing. ConditioningAon푟andpos, rather than ̆ 푎and푐alone, is the formal distinction from prior models: AgentLeak [30] defines leak- age independently of recipient identity, and Pr∈mpt [6] assumes a single user and model owner, so neither captures recipient-specific authorization, a value authorized for one recipient is not thereby authorized for a different, topology-reachable one. RECONS en- forces this directly:A( ̆ 푎,휍,푐,푟,pos 푗 )= sanitize. Possession by an authorized agent is not a violation; a violation occurs when topol- ogy exposes the value to a reachable recipient unauthorized for that field. 3.3 From Boundary Crossing to Disclosure The authorization function determines a crossing but does not itself imply disclosure, which we define as the subsequent observation of ̆ 푎in channel푐’s content at an unauthorized recipient. Leakage re- quires both. Without RECONS (§5.1), no transformation intervenes, so every crossing exposing ̆ 푎 is realized as disclosure and counted as leakage. With RECONS (§6), a crossing counts as leakage only when transformation fails to prevent recovery of ̆ 푎from푐, sepa- rating whether a recipient is authorized from whether the value is When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems Table 2: Protected-value taxonomy, defined by admitted transfor- mation. Value type 휏Sensitive byAdmitted transformation Format-dependent recognizable formatformat-preserving encryption Value-dependentthe information carried pseudonymization / mLDP Contextualmeaning in contextsemantic rewriting / redaction recoverable once received: an authorized recipient observing ̆ 푎is not a violation, an unauthorized one who cannot recover it after transformation is a crossing without leakage, and one who can recover it is leakage. 3.4 Topology Model We model a topology as푇= ( ̆ S,푘), where ̆ Sspecifies the coordi- nation pattern and푘the agent count, across six cells: star (CW- 2, CW-7), P2P (P2P-4, P2P-7, P2P-10), and hierarchical (Hier-7). CW-2 is the reference cell: with only the original two agents, no pos 푗 recipient can exist, so exposure is 0% by construction. It sits on neither axis, anchors the design to the original scenarios and cross-framework baseline, and is the baseline the rest are evaluated against in §5.1. The cells impose no total ordering over complexity; agent count does not monotonically increase exposure, and relative leakage among non-reference topologies depends on framework and generator (§5.8–§5.7). Our claim is limited to the structural distinction: every non-reference topology admitspos 푗 recipients, creating disclosure paths CW-2 lacks. Non-reference cells are con- structed by re-roling the same scenarios without expanding autho- rization policies; we analyze effects through paired within-scenario comparisons. The structure axisCW-7, P2P-7, Hier-7holds푁=7 and varies wiring: CW-7 is a star with one coordinator and six workers, P2P-7 is fully connected, and Hier-7 is a two-level hierarchy of one root, two sub-coordinators, and four workers. The scale axis P2P-4, P2P-7, P2P-10holds peer-to-peer wiring fixed and varies 푁 ∈ 4,7,10; the axes share P2P-7 as both a structure comparison and a middle-scale point (Figure 1). 3.5 Protected-Value Taxonomy We classify protected values into three classes by applicable trans- formation (Table 2). Format-dependent values (identifiers, account numbers, dates of birth) are recognizable by structure and sup- port format-preserving transformation. Value-dependent values (names, addresses, numeric amounts) are sensitive by content and support pseudonymization or mLDP. Contextual values (diagnoses, legal strategies, internal assessments) derive sensitivity from mean- ing and require semantic rewriting or redaction. This extends Pr∈mpt’s two-class distinction [6] with a contextual class aris- ing where sensitive information sits in free-form agent-to-agent text rather than a discrete field; the three classes determine which transformation applies (§6). 3.6 Adversary Model We model a passive unauthorized recipient observing one or more instrumented channels퐶 1 –퐶 7 without authorization for the value underA, canonically apos=pos 푗 agent introduced by the topology; an observer of shared logs (퐶 6 ) or persistent artifacts (퐶 7 ) is also in scope when unauthorized for that field. The adversary does not modify the execution, inject content, or obtain information beyond channels the scenario exposes, and we assume no computational limit on interpreting observed content. We consider three adversary levels [30]:퐴 0 , benign execution;퐴 1 , an external adversary targeting퐶 1 ; and퐴 2 , an internal adversary targeting퐶 2 –퐶 5 . The primary threat model excludes inference from indirect evidence, collusion among unauthorized recipients, cross- session correlation, and observation outside퐶 1 –퐶 7 ; these stronger capabilities are evaluated separately in §5.3–§5.4 and excluded from the primary leakage measurements in §5.1 and sanitizer evaluation in §6. 4 Experimental Methodology Our experiments vary topology, adversary level, protected-value class, observable channel, and execution horizon. Unless stated otherwise, the generator and framework are fixed to Qwen3-32B and LangGraph, isolating topology as the independent variable. 4.1 Corpus Construction and Evaluation Scale We derive our corpus from the public 1,000-scenario AgentLeak benchmark [30], which provides tasks, protected values, agent roles, and release policies. We construct long-horizon executions at푇=20; 22 scenarios yield no valid neighboring pair and are excluded, leav- ing 978. We then retain only true multi-agent scenarios, at least two agents, two distinct roles, and observable inter-agent coordi- nation through퐶 2 edges, yielding 485: 138 corporate, 100 finance, 100 healthcare, 147 legal. Each scenario’s vault contains multiple protected fields alongside a field-level release policy specifying allowed_setandforbidden_fields. We designate a single pro- tected attribute푃per scenario as the tracked target for paired- trajectory construction, drawn fromforbidden_fields, with un- specified fields treated as forbidden by default. For each scenario, we construct a neighboring pair(휏,휏 ′ )differ- ing only in푃, evaluated at horizons푇 ∈ 1,3,5,10,20, fixed within each scenario and held constant across topology and adversary- level conditions to preserve the corpus’s horizon distribution. Each of the 485 scenarios is evaluated under six topology cells and three adversary levels, yielding 485×6×3=8,730 execution records, each containing the pair and seven observable channels. Detection runs independently per channel and pair member, yielding 7×2=14 instances per record and 8,730×14=122,220 total (Table 3), the unit of channel-level evaluation from which record- and topology-level statistics are computed. Trace normalization. We execute each scenario through a custom- built framework-agnostic adapter normalizing traces from all eight orchestration frameworks into a common JSON Lines represen- tation, exposing events on퐶 1 –퐶 7 and recording execution and information-flow graphs for attribution and integrity checks. All executions use Qwen3-32B, served locally with vLLM [13], at tem- perature 0 with fixed seeds. Tool-call inputs and outputs (퐶 3 /퐶 4 ) come from a deterministic tool layer rather than live services, so paired executions and topology conditions differ only in protected- value substitution and communication structure. Sunday et al. Table 3: Stratification of the 122,220 evaluation instances. StratumResolving mechanismInstances Share Certain-positive Tier 1/2 exact or structured match70,28057.5% Semantic-middle Tier 3 judge36,56829.9% Certain-negative No deterministic signal15,37212.6% Total122,220 100.0% 4.2 Baseline Detection Pipeline We adopt AgentLeak’s three-tier detection methodology [30], adapted to our multi-agent traces, applied independently per chan- nel to ask whether푃is disclosed, verbatim or via a semantically equivalent expression. Authorization is evaluated separately via the recipient-conditioned policy (§3. (1) Canary and exact matching (Tier 1). Deterministically de- tects verbatim occurrences, checking observable-content cap- ture. (2) Structured-field matching (Tier 2). Deterministic recog- nizers identify SSNs, Luhn-valid cards, and ICD-10 codes; checksum-validated matches are high-confidence, pattern-only matches are flagged but not counted, and matches are restricted to the target field and its release policy. (3) LLM-as-judge (Tier 3). Resolves remaining instances by eval- uating semantic equivalence between channel content and the protected value, using Mistral-Small-24B as judge and Qwen3- 32B as generator; a score in[0,1]classifies disclosure when at least the calibrated threshold 휁 (§4.5). Each disclosure is attributed to the first detecting tier, in order: Tier 1, Tier 2, and Tier 3, preventing duplicate counting and separating exact, structured, and semantic detections. 4.3 Detection Stratification We apply the pipeline to all 122,220 instances. A deterministic pre- filter partitions them into three strata (Table 3): certain-positive, resolved by Tier 1 or 2; certain-negative, with no protected value introduced into the channel’s execution context; and semantic- middle, requiring Tier 3 assessment. Tier 3 performance is reported only on the semantic-middle stratum, since combining it with the deterministic strata would conflate exact matching with semantic- judge performance. 4.4 Calibration Corpus and Ground Truth We calibrate the Tier-3 threshold on a dedicated corpus of 720 traces generated under the CW-2 topology and퐴 0 attack level, containing 10,080 detection instances across two neighboring-pair members and seven channels. A deterministic pass assigns each instance to the three strata defined in Table 3; only the semantic-middle stratum is submitted for human annotation. Two domain-expert annotators independently label a stratified 300-instance sample, each instance receiving Leak, No-Leak, or Unsure. Disagreements are adjudicated against a written guideline evaluating disclosure of the designated attribute rather than unrelated sensitive content. After adjudication, the sample yields 32 leaks and 267 non-leaks among 299 resolved instances. Inter-annotator agreement on raw pre-adjudication labels is substantial, with Cohen’s휅=0.835 three- way and 0.846 binary at 95.7% raw agreement, where the three-way Table 4: Tier-3 threshold calibration on the main semantic-middle sample (299 instances, 32 leaks). 휁FPRFNRAccuracyPrecisionRecall 퐹 1 0.35–0.600.01120.06250.98330.90910.93750.9231 0.61–0.700.01120.09370.97990.90620.90620.9062 0.71–0.800.01120.18750.96990.89650.81250.8525 0.81–0.850.01120.21870.96650.89260.78120.8333 0.86–0.900.00750.25000.96650.92310.75000.8276 0.91–0.950.00370.37500.95650.95240.62500.7547 figure includes Unsure and the binary figure excludes any instance either annotator so marked, confirming the calibration labels are reliable. 4.5 Threshold Calibration We calibrate휁on the adjudicated semantic-middle sample. The Tier-3 judge operates at temperature 0, producing a determinis- tic score. We sweep휁 ∈ [0.35,0.95]in steps of 0.01, classifying an instance as disclosed when its score is≥ 휁, and selecting the threshold that maximizes퐹1 subject toFPR<0.05. The FPR con- straint holds throughout, with a maximum of 0.0112, so selection is determined entirely by퐹1, which is maximized at 0.9231 across 휁 ∈ [0.35,0.60), an interval containing no calibration score, leaving classification unchanged throughout. We report휁=0.50 as the representative operating point: precision 0.9091, recall 0.9375, FPR 0.0112,퐹1 0.9231, values characterizing the semantic-middle popu- lation rather than aggregate corpus performance. AgentLeak’s [30] threshold,휁=0.72, yields퐹1=0.8525 on our sample versus 0.9231 at휁=0.50, so we recalibrate rather than transfer it. As a robust- ness check, Gemma-3-27B, a different model family, independently scores the labeled sample; at휁=0.50 the two judges agree on 96.7% of instances, Cohen’s휅=0.846. Gemma-3-27B is used only for this cross-check and does not affect threshold selection or reported counts. 5 Evaluation 5.1 Topology-Dependent Leakage 5.1.1 Experimental Design. We evaluate the frozen held-out corpus under all six topology cells and three adversary levels,퐴 0 ,퐴 1 ,퐴 2 , with detector, judge, prompts, policy, and pipeline fixed throughout (§4). Our primary outcome is topology-conditioned new-agent dis- closure,퐿( ̆ 푇)= 푃(unauthorized disclosure | ̆ 푇), where ̆ 푇denotes topology. We report three metrics: (1)Surface leakage: the proportion of scenarios with at least one unauthorized disclosure in any channel. (2)New-agent disclosure: the proportion reaching a topology- introduced recipient (pos= 푝표푠 푗 ), our primary measure of topology-dependent exposure. (3)Unauthorized propagation: the proportion reaching any re- cipient outside the authorized set regardless of position. This distinction lets us determine whether topology changes over- all disclosure incidence or primarily where disclosed information propagates. 5.1.2 Topology-Conditioned Exposure. Surface leakage changes little across topologies, remaining between 60.6% and 62.8% across When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems CW-2CW-7P2P-4P2P-7P2P-10Hier-7 Topology 0 50 100 % Leakage 60.6 60.9 61.0 61.1 60.9 62.0 60.860.8 60.9 60.8 61.1 62.4 61.5 61.6 61.0 61.861.8 62.8 A 0 A 1 A 2 Figure 2: Surface leakage rate (%) by topology and adversary level. Each cell contains the proportion of the 485 scenarios exhibiting at least one unauthorized disclosure. CW-2CW-7P2P-4P2P-7P2P-10Hier-7 Topology 0 20 40 60 % Exposure 0.0 35.3 45.6 44.1 44.7 49.9 0.0 34.4 43.1 44.5 43.1 50.7 0.0 38.6 46.4 47.847.8 52.2 New-Agent Disclosure A 0 A 1 A 2 CW-2CW-7P2P-4P2P-7P2P-10Hier-7 Topology 80 82 84 86 88 90 84.3 85.4 85.885.885.8 86.0 84.3 85.6 86.086.086.086.0 84.3 86.086.086.086.086.0 Unauthorized Propagation A 0 A 1 A 2 Figure 3: Recipient-conditioned exposure (%) by topology and adver- sary level. New-agent disclosure is the primary topology-conditioned leakage measure퐿(푇). Unauthorized propagation includes any re- cipient outside the authorized set. Table 5: Cochran’s푄tests for topology and adversary-intensity effects on recipient-based disclosure. EffectMetric휒 2 df 푝 TopologyNew-agent191.842× 10 −40 TopologyPropagation94.259× 10 −19 AdversaryNew-agent16.023× 10 −4 AdversaryPropagation9.329× 10 −3 adversary levels (Figure 2), while recipient-conditioned exposure increases substantially: new-agent disclosure is 0% at CW-2 by construction, 34.4–38.6% at CW-7, 43.1–47.8% across the P2P cells, and 49.9–52.2% at Hier-7 (Figure 3). Unauthorized propagation stays high throughout, from 84.3% at CW-2 to at most 86.0% in richer topologies. At퐴 0 , the Wilson 95% confidence intervals for new-agent dis- closure are 35.3% [31.1,39.6] for CW-7, 45.6% [41.2,50.0] for P2P- 4, 44.1% [39.8,48.6] for P2P-7, 44.7% [40.4,49.2] for P2P-10, and 49.9% [45.5,54.3] for Hier-7. The corresponding interval for CW-2 is[0.0,0.8]%. We use Cochran’s푄test for formal inference because each scenario is evaluated repeatedly across topology conditions (Table 5). CW-2 is excluded from the topology test for new-agent disclosure because its outcome is structurally constant at zero. All four effects are significant at conventional thresholds (Table 5). Topology has a larger effect on new-agent disclosure (휒 2 =191.8, df=4,푝=2×10 −40 ) than on unauthorized propagation (휒 2 =94.2, df=5,푝=9×10 −19 ): topology moves new-agent disclosure over a wide range, 0% to 52.2%, but propagation only within a narrow 1.7- point band, 84.3% to 86.0%, so a smaller absolute range still registers as a strong effect once repeated-measures structure is accounted for. Adversary intensity is also significant but with much smaller Table 6: Cumulative disclosure: mean number of distinct protected values disclosed per trajectory across nested horizons. Values are judge-scored and pooled over 휏/휏 ′ (푛= 970). Scope푇 1 푇 3 푇 5 푇 10 푇 20 Behavioral (퐶 1 /퐶 2 /퐶 6 /퐶 7 )0.0200.2130.2300.2500.321 All channels (퐶 1 –퐶 7 )0.0200.2370.2510.2810.349 Tool only (퐶 3 /퐶 5 )0.0000.0570.0570.0810.089 statistics, 16.0 and 9.3 against 191.8 and 94.2, making topology the dominant driver here and adversary intensity secondary. Hence, the effect concentrates in recipient-conditioned expo- sure: surface leakage varies by only 2.2 points across cells, while new-agent disclosure rises from a structural 0% at CW-2 to 52.2% at Hier-7 under퐴 2 . Richer topologies form no strict monotonic ordering; P2P-4 exceeds P2P-7 at퐴 0 , so results reflect not agent count but communication structure changing which recipients be- come exposed to already-disclosed information. These disclosures occur through퐶 2 rather than the deterministically injected struc- tured channels, consistent with topology-dependent propagation rather than an artifact of structured-value survival. Overall, this result shows that topology primarily changes the reachable recip- ient set: richer coordination’s principal security consequence is increased unauthorized reach, even as surface disclosure incidence stays nearly unchanged. 5.2 Compositional Leakage We investigate whether disclosure accumulates as an adversary observes progressively longer trajectories, over nested horizons 푇 1 ⊂ 푇 3 ⊂ 푇 5 ⊂ 푇 10 ⊂ 푇 20 , distinguishing cumulative disclosure, distinct protected values disclosed by horizon푇 푘 , from marginal disclosure, those first disclosed between consecutive horizons, and the primary measure of compositional leakage: sustained disclo- sure at later horizons would indicate accumulation, concentration at early horizons front-loading. We evaluate behavioral channels (퐶 1 /퐶 2 /퐶 6 /퐶 7 ), all channels (퐶 1 –퐶 7 ), and tool channels (퐶 3 /퐶 5 ), in- cluding only agent-authored events. Each turn beyond the opening task is scripted as one of eight interaction archetypes (Table 25), reflecting a distinct conversational function. Disclosure is predominantly front-loaded. Cumulative disclosure increases with horizon, but most first-time disclosures occur at the first transition (Table 6). For behavioral channels, mean cumulative disclosure rises from 0.020 at푇 1 to 0.321 at푇 20 ; of 311 first-time dis- closures across 970 trajectories, 188 (60.5%) occur at푇 1 →푇 3 , versus 16 at푇 3 →푇 5 , 19 at푇 5 →푇 10 , and 69 at푇 10 →푇 20 (Table 7). The same pattern holds across all channels and tool channels: 62.2% and 64.0% of first-time disclosures, respectively, occurring at푇 1 →푇 3 : longer horizons increase cumulative exposure, but later turns add little new disclosure, and we find no evidence of sustained accumulation. Confirmation probes dominate disclosure. Confirmation probes (archetype G) account for 574 of 2,212 disclosing turns across all channels, a 25.9% rate (Table 8), versus 0.9% to 2.7% for other archetypes, the dominant disclosure context though not exclusive: 14.7% of first-time disclosures occur outside it, in handoffs, elabora- tion, justification, and closeout turns. Sunday et al. Table 7: Marginal first-time disclosures by horizon transition. Counts denote trajectories with a newly disclosed protected value among 970 trajectories; re-disclosures are excluded. Scope푇 1 푇 1 →푇 3 푇 3 →푇 5 푇 5 →푇 10 푇 10 →푇 20 Behavioral (퐶 1 /퐶 2 /퐶 6 /퐶 7 )19188161969 All channels (퐶 1 –퐶 7 )19211133066 Tool only (퐶 3 /퐶 5 )0550247 Table 8: Disclosure by interaction archetype in the all-channel scope. Rate is the fraction of turns of each archetype that disclose the protected value. ArchetypeDisclosuresTurnsRate G (confirmation probe)5742,212 0.259 F (rapport)782,9160.027 B (handoff )974,1010.024 E (closeout)622,6430.023 C (justification)673,7610.018 BASE (initial task)191,7770.011 D (error handling)363,6990.010 A (elaboration)636,6460.009 Tool channels provide an independent leakage surface. Tool chan- nels produce fewer disclosures than behavioral ones but expose a distinct surface (Table 6 and Table 7): mean푇 20 disclosure through 퐶 3 /퐶 5 is 0.089 versus 0.321 behaviorally, and is similarly front- loaded, 55 of 86 first-time tool disclosures occurring at푇 1 →푇 3 , meaning communication-only auditing would miss disclosures in tool-call arguments and memory writes. 5.3 Reconstruction: No Confirmed Emergent Recovery Direct disclosure propagates once emitted (§5.1–5.2); we now test the more serious threat of reconstruction, an adversary recovering 푃 from evidence it was never explicitly given. Inference. Whether푃is recoverable from contextual cues within a single non-disclosing channel, across 2,954 eligible instances in four domains, yields no confirmed reconstruction, 0/2,954 (Table 9). The judge produced 22 raw positives, all rejected on audit, attributable to decoy-value selection (14), field-type confusion (6), and generic topical over-attribution (2). Cross-channel. Whether two independently non-disclosing chan- nels jointly reconstruct푃, across 3,195 eligible pairs in all four domains, confirms no cross-channel linkage, 0/3,195 (Table 9). 25 raw positives (0.78%) were rejected on audit; typically, two channels independently contained the same incorrect candidate value rather than jointly recovering the true one. Cross-agent. Whether pooling two agents’ views reconstructs푃 when neither individually possesses it, over all 172,949 eligible pairs across six topology cells, yields 0 confirmed reconstructions (Table 9). 503 raw positives (0.29%) were rejected: 443 showed no evidence of the true value, and 60 contained it verbatim in a single agent’s view, possession rather than linkage. Since emergent recovery is zero on every axis, cumulative re- coverability reduces to the single-source rate; we do not report this separately. A complementary turn-level view (§5.2) shows first-time Table 9: Reconstruction results by aggregation axis. All positives were manually audited; emergent recovery is zero on every axis. AxisEligibleRaw positives Single_srcAudited Inference2,9542239.5%0 Cross-channel3,1952533.0%0 Cross-agent172,94950387.2%0 Table 10: Pairwise distinguishability by horizon. The푇 5 signal does not survive the confound analysis below. HorizonReal accuracyReal advantageShuffled advantage 푇 1 0.502+0.002−0.000 푇 3 0.531+0.031−0.008 푇 5 0.566+0.066−0.002 푇 10 0.537+0.037−0.000 푇 20 0.500+0.000−0.004 disclosures are front-loaded rather than accumulating, 211 of 339 (62%) occurring at the first transition,푇 1 →푇 3 , describing timing of direct disclosure, not reconstruction. Across 179,098 exhaustively evaluated instances and pairs, every raw positive manually audited, we find no confirmed evidence a withheld attribute is reconstructed from non-disclosing content, alone or combined, under the evalu- ated corpus and protocol, though this does not establish absence under other corpora or strategies. 5.4 Behavioral Leakage A distinct threat is푃influencing observable behavior without being disclosed. We measure this over 33 structural features per trajectory encoding nothing of푃: pairwise distinguishability between neigh- boring executions, and population-level prediction of푃’s semantic category. 5.4.1 Pair Distinguishability. Method. We identify 244 matched pairs(휏,휏 ′ )differing only in 푃, with no judge-confirmed disclosure on either side (488 trajecto- ries); a logistic-regression distinguisher predicts휏versus휏 ′ from behavioral features under scenario-grouped cross-validation, with distinguishing advantage asaccuracy−0.5 against a shuffled-label null per horizon. Results. The advantage is transient, not monotonic, near-random at푇 1 (50.2%), peaking at푇 5 (56.6%), near-random again at푇 20 (50.0%). The푇 5 result is statistically distinguishable from the null (푧 ≈12.8), though distinguishability alone does not establish a푃-dependent side-channel, tested directly below. Confound analysis. Confound analysis attributes the푇 5 signal to corpus construction, not푃, on three grounds. A genuine fingerprint should not favor one pair member arbitrarily assigned; four of the eleven strongest푇 5 features show directional bias (|푡| ≥2, e.g. tool_calls_archetype_Afavoring휏in 8/244 pairs and휏 ′ in none). Generation order is perfectly confounded with pair label,휏always generated before휏 ′ (corr=1.000), leaving no within-pair variation to isolate an order effect. And the protected value itself does not explain the difference: value-length and response-length correlate at only푟=0.06, yet equal-length values (e.g.63000vs.75267) still produce∼ 100-character response differences. When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems Table 11: Order-invariant control: real matched pairs vs. synthetic re-pairings. HorizonReal advantageShuffled null 푇 1 +0.367 −0.018 푇 3 +0.346 −0.008 푇 5 +0.342 −0.015 푇 10 +0.338 −0.007 푇 20 +0.207 −0.011 As an order-invariant alternative, comparing true pairs against domain-constrained synthetic re-pairings yields larger advantages (0.21–0.37, Table 11) than the original 0.066, with all 18 non-trivial features showing smaller within-pair differences for real than syn- thetic pairs (ratios 0.13–0.69), consistent with scenario identity and task similarity rather than a targeted fingerprint. A definitive test would require randomized generation order or repeated genera- tions per scenario; without that, we treat푇 5 as confounded, not behavioral leakage. 5.5 Synthesis: Leakage Is Primarily Direct and Propagative. Explicit disclosure propagates across agents, channels, and turns; all three reconstruction axes yield zero confirmed emergent recovery across 179,098 exhaustively evaluated instances and pairs, every raw positive manually audited, and behavioral analysis finds no persistent value-level fingerprint. The dominant leakage pathway is thus direct disclosure followed by propagation: richer topology expands the recipient set for an already-disclosed value, and longer executions add further disclosure opportunities. These findings motivate defenses constraining initial disclosure and subsequent propagation (§6). 5.6 Cross-Framework Leakage Measurement This experiment evaluates whether orchestration framework choice affects privacy leakage under an identical corpus, generator, autho- rization policy, and detection pipeline. 5.6.1 Experimental Design. We evaluate the same 485 scenar- ios across eight frameworks: AutoGen [29], CrewAI [2], Google ADK [1], LangChain [14], LangGraph [15], LlamaIndex [23], Ope- nAI Agents SDK [3], and Semantic Kernel [24], each scenario runs as an attribute-neighboring pair(휏,휏 ′ ), yielding 485×8×2=7,760 executions. All use the same generator (Qwen3-32B via vLLM), deterministic decoding, identical prompts, tools, and attribute as- signments, with events collected over퐶 1 –퐶 7 and normalized into the common trace schema introduced in §4.1, totaling 214,853 as- sessable channel events across frameworks. Each framework runs through its native coordination abstraction, delegation, handoffs, workflows, or group chat, rather than a framework-independent layer, preserving the communication behavior that is the object of comparison. 5.6.2 Detection and Authorization. Leakage detection uses the frozen three-tier pipeline (§4.2); the judge is identical across frame- works and never evaluates its own model family’s outputs. Detec- tion and authorization are evaluated separately: the judge decides Table 12: Leakage and value fidelity across eight orchestration frameworks, sorted by policy-filtered leakage. FrameworkRaw leakage Policy-filtered leakage Value fidelity AutoGen43.85%43.38%87.15% LangChain25.54%25.50%25.59% LangGraph23.75%23.71%26.40% CrewAI21.61%21.01%27.75% Semantic Kernel1.56%0.67%67.11% LlamaIndex0.72%0.50%36.23% OpenAI Agents SDK1.56%0.48%42.55% Google ADK0.80%0.29%47.06% Overall21.63%21.44%48.47% only whether the attribute appears, and authorization is applied afterward against the field-level release policyA( ̆ 푎,휍,푐,푟,pos)(§3). We report: (1) Raw leakage: all semantic detections; (2) Policy-filtered leakage: detections excluding disclosures explicitly authorized by the scenario policy. The latter corresponds to the contextual- integrity violation used for all comparisons below. 5.6.3 Value Fidelity Verification. Since detection does not verify the disclosed value is correct, we measure value fidelity independently for canonical attributes (identifiers, phone numbers, dates of birth, account numbers, canary tokens, names), comparing generated val- ues against ground-truth values after canonicalization, classifying each as exact, corrupted, or substituted, reported independently to rule out framework rankings explained by confabulation. 5.6.4 Framework Leakage Rates. Table 12 reports raw leakage, policy-filtered leakage, and value fidelity per framework, sorted by policy-filtered leakage. The frameworks separate into two groups: AutoGen, LangChain, LangGraph, and CrewAI between 21.0% and 43.4% filtered leakage; Semantic Kernel, LlamaIndex, OpenAI Agents SDK, and Google ADK below 0.7%. The gap between groups, CrewAI 21.01% to Se- mantic Kernel 0.67%, is roughly 31×, and the overall extremes, AutoGen 43.38% versus Google ADK 0.29%, roughly 150×. This two-group separation is the reliable finding, not the ordering within each group: §5.6.6 establishes a cross-corpus noise floor no larger than 0.41 points, and every low-group gap, 0.02–0.19p, falls well below it, so those four should be read as tied. The high-group’s internal gaps, 1.79–17.88p, exceed the floor by an order of mag- nitude and are reliably ordered. The authorization filter changes overall leakage by only 0.19 points, and the two-group separation is unchanged after filtering. As shown in Figure 4, leakage concentrates in non-user-facing channels: tool inputs (퐶 3 ) and outputs (퐶 4 ) exhibit the highest rates, followed by artifacts (퐶 7 ), inter-agent communication (퐶 2 ), and shared memory (퐶 5 ), while user-facing outputs (퐶 1 ) account for substantially fewer disclosures, showing that evaluating only final responses understates privacy exposure in MALS. 5.6.5 Value Fidelity Is Independent of Leakage. Leakage frequency and value fidelity measure different properties. AutoGen leaks most frequently while reproducing values most accurately (87.15%); Lla- maIndex leaks rarely but correctly only 36.23% of verifiable cases, Sunday et al. C 1 C 2 C 3 C 4 C 5 C 6 C 7 Channel 0 20 40 % Leakage 12.63 35.69 48.73 48.71 34.35 5.85 38.77 Figure 4: Leakage rates across observable channels on all frame- works. Table 13: Policy-filtered leakage (%) across four independently gen- erated corpora. Deltas are relative to the temperature-0.0 corpus of record. FrameworkTemp. 0.0 Temp. 0.2 (Δ) Temp. 0.5 (Δ) Temp. 0.7 (Δ) AutoGen43.38 43.34 (−0.04) 43.41 (+0.03) 43.25 (−0.13) LangChain25.50 25.59 (+0.09) 25.69 (+0.19) 25.87 (+0.37) LangGraph23.71 23.79 (+0.08) 23.90 (+0.19) 23.93 (+0.22) CrewAI21.01 21.40 (+0.39) 21.04 (+0.03) 21.41 (+0.40) Semantic Kernel0.670.82 (+0.15)0.82 (+0.15)0.84 (+0.17) LlamaIndex0.500.45 (−0.05)0.49 (−0.01)0.41 (−0.09) OpenAI Agents SDK0.480.50 (+0.02)0.54 (+0.06)0.52 (+0.04) Google ADK0.290.37 (+0.08)0.32 (+0.03)0.40 (+0.11) Overall21.44 21.53 (+0.09) 21.59 (+0.15) 21.67 (+0.23) so low leakage can reflect avoided disclosure or incorrect and sub- stituted values, fidelity requiring independent measurement. To rule out confabulation as the source of framework ranking, we joined per-instance fidelity with leakage decisions: exact-value disclosures were almost always detected, substituted values were never classified as valid, and the two-group separation persists when restricted to exact-value disclosures, so the grouping is not explained by confabulation. 5.6.6 Robustness Across Generation Regimes. We evaluate robust- ness using three additional corpora from the identical scenario pool and configurations under temperatures 0.2, 0.5, and 0.7, each un- seeded, comparing policy-filtered leakage against the temperature- 0.0 corpus of record (Table 13). Framework-level leakage is stable across the range: the high- and low-leakage groups remain separated by more than 19.8 points at every temperature, with no framework changing group mem- bership. Maximum per-framework drift from the temperature-0.0 anchor is small throughout (0.39p at 0.2, 0.21p at 0.5, 0.41p at 0.7) but non-monotonic, temperature 0.5 being a local minimum; the framework responsible for the maximum shifts too, CrewAI at 0.2 and 0.7, LangChain at 0.5, since CrewAI’s own drift briefly turns negligible and negative at 0.5, attributed below to CrewAI specifically rather than temperature. The apparent low-leakage-group instability noted earlier does not hold under the complete four-regime picture. The raw met- ric gives an identical ordering: Semantic Kernel, OpenAI Agents SDK, Google ADK, LlamaIndex, at all four temperatures, no raw- metric swap ever occurring. The policy-filtered ordering shows one inversion, LlamaIndex above OpenAI Agents SDK, only in the fixed-seed temperature-0.0 corpus; the three unseeded regimes independently agree on Semantic Kernel, OpenAI Agents SDK, Lla- maIndex, Google ADK, so the inversion is best read as specific to that corpus rather than an instability recurring under resampling. All four low-leakage frameworks remain far below the high-leakage group’s own internal noise floor regardless of metric or regime, and should be read as tied rather than ranked. Under fixed temperature and seed, event content reproduces identically in 83.99% of cases at temperature 0.0, the residual re- flecting floating-point non-determinism rather than sampling and not eliminable by seeding; reproducibility does not degrade at higher temperature (89.92% at 0.5, 89.68% at 0.7). CrewAI accounts for nearly all residual non-reproducibility at every temperature (3/16, 3/16, 4/16 mismatched pairs at 0.0, 0.5, 0.7, against 0/16 for LangChain and LangGraph throughout), consistent with driving the non-monotonic drift above; framework-level aggregate rates remain stable regardless, indicating the effect reflects aggregate behavior over hundreds of trials rather than any single genera- tion path. This claim establishes stability under generation vari- ance across temperatures 0.0 through 0.7 only; it does not address scenario-sampling, judge-choice, or threshold-recalibration sensi- tivity, and the non-monotonic temperature relationship should not be extrapolated beyond the tested range. 5.7 Model Generalization The topology gradient in §5.1 was initially measured using Qwen3- 32B. To assess generalization across generators, we repeat the sweep with three additional models from distinct families, GPT-5-mini, Gemini-3.7-Flash, and Llama-3.3-70B, holding framework, corpus, topology, pipeline, and detector fixed across all 485 scenarios and six cells. This separates whether topology-induced exposure occurs from how frequently it does. The former is consistent across gen- erators, whereas the latter varies substantially, with cell ordering unpreserved across models. 5.7.1 Topology-induced exposure generalizes, but its magnitude varies. Topology-induced exposure occurs for every generator (Fig- ure 5). CW-2 yields no detected disclosure for any model, while every richer topology yields a non-zero rate for all four; the small- est, 9.3% for Gemini-3.7-Flash, remains separated from CW-2’s confidence bound, so the effect is not specific to Qwen3-32B. The magnitude differs substantially across generators. Over richer cells, GPT-5-mini ranges 57.1–65.8%, Qwen3-32B 35.3–49.9%, Llama- 3.3-70B 21.4–23.5%, and Gemini-3.7-Flash 9.3–11.5%, so identical nominal structures yield very different rates by generator (Figure 5). Ordering also varies: Qwen3-32B peaks at Hier-7 (49.9%), while the other three instead rise sharply from CW-2 and then vary nar- rowly. These results are unsupportive of any model-independent topology-to-rate mapping. The highest-to-lowest richer-cell gap, 65.8% versus 9.3%, roughly sevenfold, is reported descriptively: GPT- 5-mini shows generation variability even at temperature zero, so small differences among its cells are not a definitive ranking. The robust observation is separation between model-level ranges, not internal ordering within any one model. When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems CW-2CW-7P2P-4P2P-7P2P-10Hier-7 Topology 0 25 50 75 % New Agent Disclosure Rate 0.0 35.3 45.6 44.1 44.7 49.9 0.0 58.4 62.5 65.4 65.8 57.1 0.0 11.5 10.9 10.7 9.39.3 0.0 22.5 23.3 23.5 21.6 21.4 Qwen3GPT-5-miniGemini-3.7-FlashLlama-3.3 Figure 5: New-agent disclosure rate by topology cell across four generator models under LangGraph (푛=485 scenarios per cell). Exposure magnitude and cell ordering vary across generators in richer topology cells. 5.7.2 Model behavior contributes to exposure variation. Gemini- 3.7-Flash’s comparatively low, flat gradient motivated closer in- spection of its Hier-7 executions. A manual recheck of sampled non- disclosing runs found no missed disclosures to topology-introduced agents; judge scores were 0.0 for 87% of examined events, well below휁=0.50, and topology construction was verified, giving no evidence of construction failure or a threshold artifact. Residual exposure instead tracks attribute type (Table 26): struc- tured identifiers (SSN, date of birth, phone, email, account number, salary, balance, credit score) are rarely forwarded (0.0–3.7%), while contextual and narrative attributes reach far higher rates, confi- dential strategy 27.6%, internal notes 36.4%, criminal history 63.6%, consistent with the flat cross-topology pattern and illustrating why an aggregate rate can conceal which information types actually propagate; we do not interpret this as a universal model property. 5.7.3 Implications for Topology-Aware Privacy Enforcement. The model sweep adds a second generalization dimension beyond the framework comparison in §5.6: nominally equivalent topologies expose differently under different orchestration semantics, and the same topology and framework expose differently across genera- tors. Neither topology nor generator identity alone establishes that a flow is authorized, since one generator’s high exposure under a topology can be another’s low exposure, and a generator sup- pressing structured identifiers may still propagate contextual ones. RECONS addresses this at the point of detected disclosure rather than by assumption, evaluating realized recipient and execution context before preserving, transforming, or suppressing a value (§6). Since propagation depends on both orchestration and genera- tion, this result reinforces recipient-conditioned enforcement on realized information flow over static assumptions about topology or generator. 5.8 Framework Generalization Topology-dependent exposure observed earlier (§5.1) may depend on LangGraph’s execution semantics, so we replicate the full sweep in AutoGen, a message-passing framework, holding the genera- tor fixed to Qwen3-32B from the same endpoint and reusing the framework-agnostic pipeline and frozen detector, across all 485 sce- narios in each of six cells, 2,910 scenario-cell executions total. This addresses whether topology-introduced exposure persists across frameworks, whether its magnitude is comparable, and whether the topology-specific pattern is preserved: the first is affirmed, the latter two are not, with exposure occurring in both frameworks but differing in magnitude and distribution across cells. 5.8.1 Cross-Framework Replication. Exposure is observed in every richer cell in both frameworks (Fig- ure 6) . CW-2 is a structural anchor with no topology-introduced recipient, so its rate is 0% in both, a consequence of the metric definition rather than freedom from other disclosures. For richer cells, AutoGen ranges 20.2–37.5% versus LangGraph’s 35.3–49.9%, so the effect is not LangGraph-specific, though magnitude and or- dering are not preserved: LangGraph peaks at Hier-7 (49.9%), while AutoGen peaks in the P2P cells (37.5%), with Hier-7 substantially lower (24.7%). Thus, nominal topology does not uniquely determine exposure magnitude; the same topology yields different rates under different orchestration semantics. CW-2CW-7P2P-4P2P-7P2P-10Hier-7 Topology 0 25 50 % New-agent Disclosure 0.0 35.3 45.6 44.1 44.7 49.9 0.0 20.2 37.537.537.5 24.7 LangGraphAutoGen Figure 6: New-agent disclosure rate by topology cell for LangGraph and AutoGen over the full corpus (푛=485 per cell), using the same Qwen3-32B generator. Topology-introduced exposure occurs in every richer cell in both frameworks, but its magnitude and topology- specific ordering differ. 5.8.2 Realized-Path Analysis. The cross-framework differences suggest nominal topology does not fully determine realized prop- agation, so we examine whether the exposure gap tracks the re- alized communication path, focusing on Hier-7, the largest cross- framework difference (49.9% LangGraph versus 24.7% AutoGen). For each execution, we identify the disclosing agent as the ear- liest to access the protected value via a vault channel, recover realized inter-agent edges (퐶 2 ) from the trace, and compute mini- mum graph distance from that agent to each topology-introduced recipient. We partition executions as direct-access if at least one such recipient is one hop away, or relay-required if every one is at least two hops away, capturing whether reaching them requires intermediate agents. Executions where the value never enters a vault channel have no defined disclosing agent or distance and are excluded from this analysis (retained in cell-level results): Lang- Graph has 62 such executions, leaving 423 with a defined disclosing agent, while AutoGen has none, leaving all 485. We report these denominators explicitly since the hop analysis is conditional on the value entering execution. The decomposition shows substantially different patterns (Ta- ble 14): AutoGen exposure is 34.0% for direct-access executions versus only 2.8% when relay-required, while LangGraph’s corre- sponding rates are 55.9% and 60.3%, so relay hops attenuate strongly in AutoGen but not LangGraph. The 95% CI for AutoGen relay- required is[1.1,7.0]% versus[51.6,68.4]% for LangGraph, widely separated intervals indicating a substantial conditional-exposure Sunday et al. Table 14: Realized-path decomposition of new-agent disclosure in Hier-7, measured from each framework’s퐶 2 execution traces. Rates are reported with 95% Wilson confidence intervals (CI). The analysis is conditional on a defined disclosing agent (423 LangGraph executions, 485 AutoGen executions). Hier-7 executionsAutoGenLangGraph Direct-access34.0% [29.2,39.2], 푛=34155.9% [50.2,61.4], 푛=297 Relay-required2.8% [1.1,7.0], 푛=14460.3% [51.6,68.4], 푛=126 Observed patternstrong attenuationno comparable attenuation Table 15: AutoGen relay-failure rate by topology cell. The P2P cells require no relay. Topology cellRelay-failure rate Hier-78.5% CW-712.2% P2P-4 / P2P-7 / P2P-100.0% difference; LangGraph’s direct-access and relay-required estimates are similar (55.9% versus 60.3%), showing no hop-based attenuation there. This refines the cell-level result: exposure depends not only on whether topology introduces additional recipients, but whether the value persists along the realized path to them. 5.8.3 Evidence for a Relay-Semantic Explanation. The traces are consistent with different relay semantics across frameworks. In Au- toGen, relay-required propagation involves successive inter-agent exchanges; the value must be retained and reproduced across mul- tiple messages to reach a downstream recipient, and the lower relay-required exposure is consistent with propagation failures across these exchanges. LangGraph instead maintains shared state along the relevant path, keeping earlier information available to downstream agents, consistent with showing no exposure reduction when recipients require additional relay hops. A separate trace-level measure supports this: AutoGen relay failures occur in multi-hop CW-7 and Hier-7 at 12.2% and 8.5%, while P2P cells, requiring no relay, show 0% (Table 15). Relay failure is distinct from leakage: it records failure to propagate through a required relay operation, while leakage records whether the value is ultimately disclosed. These observations are consistent with a relay-semantic explanation for the AutoGen–LangGraph difference, though they do not establish message reproduction or shared-state execution as the sole cause; scheduling, state management, and execution control may also contribute. 5.8.4 Implication for Topology-Aware Privacy Enforcement. This analysis distinguishes nominal topology from realized information flow: the specified graph determines possible paths, but observed ex- posure also depends on how an orchestrator realizes and preserves information along them, so agent count, edge count, and topol- ogy class alone cannot characterize exposure. A sanitizer should therefore not infer authorization from a protected value’s pres- ence or nominal topology alone; the decision should incorporate the intended recipient and observable communication context, an authorization decision being a fusion of value, realized recipient, and context. Therefore, we develop RECONS, operationalizing this by conditioning sanitization on recipient and observable execu- tion context rather than a fixed transformation per detected value. The cross-framework results motivate the recipient- and context- conditioned enforcement evaluated in §6. 6RECONS: Recipient-Conditioned Sanitization The evaluated multi-agent LLM workflows exhibit predominantly direct and propagative leakage: a value disclosed by one agent can propagate through channels and execution steps to an agent unau- thorized to receive it (§5.5). We did not observe successful recon- structive or behavioral side-channel leakage, which does not es- tablish absence in general but identifies disclosure detection and propagation control as the primary mitigation targets this evalua- tion supports. RECONS implements these as a three-stage pipeline, Detect→ Decide→Transform, as shown in Figure 7. Detection identifies candidate values and assigns a type and confidence score, deci- sion determines whether the detected value is authorized for the intended recipient under observed context, and transformation ap- plies a type-appropriate operation when disclosure is unauthorized, separating what information is present, whether it may be disclosed, and how unauthorized information should be transformed. 6.1 Positioning Existing mechanisms operate at the user–LLM boundary or ap- ply recipient-independent transformations. AgentLeak’s blanket- redaction interceptor removes detected content uniformly, costing 4.7 points of task success; Presidio and commercial DLP similarly de- tect predefined types and apply fixed transformations; Pr∈mpt [6] provides token-level FPE and metric-LDP but targets single-agent, single-prompt settings without modeling recipient-dependent dis- closure across agents. RECONS instead targets values authorized for one recipient but not another as they propagate through a workflow, centered on a recipient-aware authorization layer extending a field-level allowed- set policy with the actual recipient when observable, coupled with a type-aware transformation layer: FPE for format-preserving needs, pseudonymization for non-numeric value-dependent attributes, mLDP where numeric perturbation is acceptable, contextual rewrit- ing for sensitive free text, and redaction as fallback. RECONS oper- ates as an inline interceptor, evaluating each agent-authored event before it reaches a downstream agent, tool, memory component, or recipient, distinguishing it from post-hoc sanitization and let- ting transformed content participate in subsequent steps, including legitimate returns to an originating agent. 6.2 Architecture RECONS processes events on퐶 1 –퐶 7 in three stages: •Detection. Identifies candidate values, assigns a type, and records confidence. •Decision. The authorization policyA( ̆ 푎,휍,푐,푟,pos)determines whether value ̆ 푎may be disclosed on channel푐to recipient푟at topology positionpos, passing authorized disclosures unchanged and forwarding unauthorized ones to transformation. • Transformation. Selects an operation by value type and re- quired utility: FPE for format-sensitive values, mLDP for numeric When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems Inputs Message Content (text, files, metadata) Recipient (agent, tool, memory, artifact, user) Execution Context (task, step, history, framework) Authorization Policy (who can access what) Sensitive Data Detector (Tier 1&2: rule-based + Tier 3: LLM) Entity Recognition (PHI, PII, financial, legal, etc.) Context-aware Analysis (semantic + intent) Output: labelled sensitive spans and metadata 1. Detect Identify sensitive information Recipient Policy Lookup (role, permissions, topology) Context-aware Risk Scoring (sensitivity x recipient x context) Policy Decision (allow / sanitize / block) Output: action decision, and transformation plan 2. Decide Check authorization Redact (remove / mask / replace) Summarize (abstract sensitive details) Rephrase (preserve utility, reduce risk) Output: sanitized message 3. Transform Apply recipient- conditioned sanitization Safe Message (to be delivered to recipient) Audit Log (action taken, reason, confidence score) Trace Update (for unified trace store) RECONS Sanitizer Recipient-Conditioned Privacy Enforcement Sanitized Output Figure 7: RECONS recipient-conditioned privacy enforcement. The sensitive information detector identifies what may be sensitive in the message. Policy decision engine determines what to do based on who can receive it and in what context. The sanitization module modifies the message according to the decision. Trace & audit logger provides transparency and supports post-hoc auditing. values where approximate utility suffices, pseudonymization for the corpus’s non-numeric value-dependent attributes, contextual rewriting for free text, and redaction when no suitable transfor- mation applies. The three types are defined by the transformation they require: format-sensitive values need representation preserved over content; value-sensitive values contribute numerically or semantically to downstream computation and should be preserved approximately; context-sensitive values derive sensitivity from meaning rather than surface form and require rewriting or removal. This typing inter- faces detection with transformation (§6.4–6.5, evaluated in §6.6). 6.3 Detection Layer The detector must identify protected values across heterogeneous agent-authored channels while providing information sufficient for authorization and transformation. Since the corpus contains both structured values and contextually sensitive free text, a single mechanism is insufficient, so RECONS uses a three-tier detector progressing from cheap pattern-based detection to semantic analy- sis. 6.3.1 Design. The detector comprises three tiers: •Tier 1: rule and NER detection. Pattern matching and named- entity recognition for structured values, SSNs, account and card numbers, phone numbers, identifiers, amounts, and dates, with checksum validation and domain-specific recognizers where generic rules fall short. •Tier 2: zero-shot NER. GLiNER [32] extends coverage to en- tities lacking reliable patterns or conventional rules, replacing a Tier-1 detection only when its confidence exceeds Tier-1’s, otherwise retaining the higher-confidence Tier-1 result. •Tier 3: contextual LLM detection. A calibrated judge identifies information expressed semantically rather than by pattern or entity type, a pending lawsuit, a strategic decision, a health con- dition in prose. It operates on free-text channels퐶 1 ,퐶 2 ,퐶 6 and the semantic content of퐶 5 and퐶 7 , using the pinned Mistral- Small-24B judge at threshold휁=0.50 with a fixed prompt hash calibrated on held-out labels; each detection yields a can- didate(span, value, value_type, channel), wherevalue_type ∈ format_dependent, value_dependent, contextual. Each detection retains its source tier and confidence, treated as evidence rather than ground truth downstream, letting the decision Table 16: Pre-tuning detection recall by value type over 3,262 posi- tive instances. Value typeRecallCaught / total Value-sensitive85.0%731 / 860 Format-sensitive65.1%1023 / 1571 Context-sensitive36.0%299 / 831 Overall62.9%2053 / 3262 layer account for reliability differences across channels and value types. 6.3.2 Validation Protocol. We validate on a development split, re- serving held-out scenarios exclusively for end-to-end evaluation (§6.5.3): 80 scenarios (16.5%) development, 405 held-out. Across both 휏and휏 ′ executions, the detector processes 12,606 agent-authored in- stances with known ground truth. Recall is computed over positive instances stratified by value type, domain, channel, and attribute; precision is estimated by manual annotation of sampled detections. Protected attributes are enumerated before evaluation and assigned a value type, with domain-specific recognizers added where generic detection is insufficient. 6.3.3 Results: Detection Varies by Value Type. Pre-tuning detec- tion varies substantially by value type (Table 16): among 3,262 positive instances, recall is 85.0% for value-sensitive, 65.1% for format-sensitive, and 36.0% for context-sensitive values, with struc- tured identifiers likessn,email,insurance_id, andnamedetected more reliably than weakly patterned numeric values and contex- tual attributes. This exposes a surface-level detection limitation: contextual attributes like a chief complaint or internal note can be privacy-sensitive without a distinctive lexical, entity, or formatting signal, making a semantic tier necessary rather than merely an enhancement. LLM tier. Since rule and NER tiers achieve only 36.0% recall on context-sensitive values, we evaluate the Tier-3 judge on 60 devel- opment instances, 40 positive (stratified between cases detected and missed by preceding tiers) and 20 negative controls: the judge identifies 39 of 40 positives with no false positives on controls, demonstrating semantic-tier utility for these sampled cases with- out characterizing population-level precision or recall. The judge’s operating point is inherited fr Sunday et al. Table 17: Pre-tuning recall for format-sensitive values across chan- nels, isolating channel representation from value-type composition. ChannelKindRecall 퐶 2 (inter-agent)free-text85.3% 퐶 6 (logs)free-text83.7% 퐶 7 (artifacts)mixed79.3% 퐶 1 (final output)free-text73.7% 퐶 4 (tool outputs)mixed71.6% 퐶 5 (memory writes)structured 40.5% 퐶 3 (tool arguments)structured 39.2% 6.3.4 Channel Dependence. Detection performance also depends on channel representation. Comparing format-sensitive values across channels to reduce value-type confounding (Table 17), recall is substantially lower on structured channels,퐶 3 tool arguments (39.2%) and퐶 5 memory writes (40.5%), than on free-text channels like퐶 2 (85.3%) and퐶 6 (83.7%). Since low detection confidence does not imply low privacy risk, and the weakest-detection channels are also where substantial disclosure occurs, RECONS treats con- fidence as channel-conditioned evidence rather than a direct risk proxy, using conservative fallback where detection and recipient resolution are insufficient. 6.3.5 Precision and Tuning. An automatic span-overlap proxy es- timates precision at 15.7%, but treats detections of untracked sen- sitive fields as false positives; manual inspection of 40 sampled non-target detections found 35% actually contained sensitive con- tent belonging to other fields, with remaining errors mostly field labels misclassified as values and agent identifiers like “A1” and “A2” misclassified as PII. A tuning pass on the development split fixed these failure modes without reducing recall anywhere: overall recall rose from 62.9% to 66.7%, format-sensitive recall from 65.1% to 73.0%, with the largest gain in local phone numbers, 19.6% to 99.3%, after adding a format-specific recognizer. 6.3.6 Carried-Forward Limitations. Three limitations carry for- ward to the decision layer: structured channels have lower recall than free-text channels for the same value type; agent identifiers and canary-like tokens can be textually ambiguous, creating corpus- specific precision-recall trade-offs; and contextual coverage depends on, and inherits the operating characteristics of, the calibrated Tier- 3 judge. These motivate a decision policy operating under incom- plete, uncertain observations rather than treating detector output as a complete representation of privacy risk. 6.4 Decision Layer The decision layer is RECONS’s policy component. Given a detected value, its type and confidence, channel, recipient, and topology position, it selects an actionA( ̆ 푎,휍,푐,푟,pos) ∈ allow, fpe,푚ldp, rewrite, redact. It first determines whether disclosure is authorized, then selects a value-type-compatible oper- ation when protection is required. The transformation layer (§6.5) executes the selected operation. This design targets propagative leakage by sanitizing a value reaching an unauthorized recipient while preserving authorized disclosures. 6.4.1 Authorization Source. RECONS reuses the field-level re- lease policy underlying the topology leakage metric (§5.1): each value specifies its authorized agents, with authorization reassigned across topology cells so richer-topology-introduced agents are unauthorized by construction, the same ground truth used by new_agent_disclosed_rate. Recipient resolution applies only where an explicit inter-agent boundary exists in the corpus: event_recipientidentifies recipients for inter-agent messages (퐶 2 ), and memory reads (퐶 5 -memory_read), with no recipient de- fined for퐶 1 ,퐶 3 ,퐶 4 ,퐶 5 -memory_write,퐶 6 , or퐶 7 . So, recipient-aware enforcement operates only on퐶 2 and퐶 5 reads, the rest using the field-level policy. This also explains why so few authorized cases exist for assessing over-sanitization: the policy authorizes relatively few fields per recipient, leaving only 17 should-allow cases in the evaluated subset (Table 18). 6.4.2 Static and Dynamic Policies. We compare two policies dif- fering only in recipient awareness. Static-Aapplies the field-level allowed set regardless of actual recipient, while Dynamic-Aadds recipient-specific authorization via three rules. •Recipient authorization. Allows a value if the resolved re- cipient is authorized; otherwise, sanitizing by value type, FPE for format-dependent, pseudonymization or mLDP for value- dependent, rewriting for contextual, redaction as fallback. •Confidence-conditioned protection. Defaults uncertain de- tections toward protection where a recipient is resolvable. This rule is inapplicable to퐶 3 because no recipient is defined for that channel and of limited use for퐶 5 reads in this split. •Topology-position extension. Sanitizes values graph- reachable from an authorized immediate recipient to an unauthorized agent. This extension is evaluated separately and excluded from the core policy. 6.4.3 Decision-Layer Validation. We evaluate decision correctness on the development split independently of transformed outputs. Among 4,834 protected-value occurrences, the detector identifies 3,400 (70.3%). Because recipient-aware decisions require a resolv- able recipient, analysis is restricted to 2,109 occurrences both de- tected and resolvable on퐶 2 or퐶 5 reads. Thus, the results in this section are conditional on successful detection and recipient reso- lution. End-to-end performance is evaluated separately in §6.6. We distinguish under-sanitization—a required-protection value allowed, constituting a privacy failure—from over-sanitization, an authorized value unnecessarily sanitized, incurring a potential util- ity cost. Recipient-aware authorization removes topology-induced under- sanitization. Among 2,092 occurrences requiring sanitization, Static- Aallows 50 (2.39%) to pass, all when a field-level-permitted value reaches an unauthorized topology-introduced agent, while Dynamic-Aallows none (Table 18), eliminating these by condition- ing authorization on the resolved recipient. Neither policy over- sanitizes the 17 should-allow cases. However, given the small sam- ple, this result indicates no observed over-sanitization rather than a utility advantage. Operation selection follows value type. The 2,092 sanitization de- cisions comprise 1,260 FPE, 480 mLDP/pseudonymization, and 352 When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems Table 18: Decision correctness on the detected, recipient-resolvable development subset (푛=2,109). Dynamic-Aeliminates the 50 topology-induced under-sanitization cases observed under Static-A. Static-ADynamic-A Under-sanitization2.39%0.00% should-sanitize, allowed (/2,092)500 Over-sanitization0.00%0.00% should-allow, sanitized (/17)00 rewriting operations. Each decision selects the operation associ- ated with its assigned value type, with no observed type-operation mismatch. 6.4.4 Topology-Position Extension. The topology-position extension tests whether authorization of the immediate recipient is sufficient in richer communication graphs. Of the 17 cases allowed by the core Dynamic-Apolicy, unrestricted graph reachability reclassifies 14 as requiring sanitization, corre- sponding to an 82% over-sanitization rate among these authorized cases. This result illustrates a limitation of unrestricted potential reachability. An authorized recipient may have a graph path to an unauthorized agent even when the value is never forwarded along that path. Therefore, applying reachability alone would impose unnecessary sanitization. The extension is consequently excluded from the core policy. A more targeted approach would condition topology analysis on observed forwarding or other evidence that the value is actually being propagated. 6.5 Transformation Layer The transformation layer executes the decision layer’s selected action (§6.4), passing content through unchanged when the de- cision is allow, without independently re-evaluating authoriza- tion; it applies operation-specific verification checks. We verify the mechanisms on a fixed 103-occurrence development sample from 12 scenario-topology-cell pairs, each re-evaluated using the same pinned Tier-3 detector used throughout, so results character- ize mechanism behavior under the study’s instrument rather than an independent non-disclosure guarantee. End-to-end leakage is evaluated separately on the full held-out set in §6.6. 6.5.1 Transformation Operations. FPE for format-dependent val- ues. FPE transforms format-dependent values, identifiers, account numbers, dates of birth, and canary tokens, using F3-1. The trans- formation is reversible with the encryption key for authorized downstream recovery. Development verification found a boundary case: short-domain attributes like the three-digitcredit_score fail F3-1’s minimum domain-size requirement, and an initial im- plementation padding and truncating ciphertext to restore original length broke invertibility. We removed truncation and retain the full padded ciphertext instead, treating these as representation-length exceptions rather than strict length-preserving FPE. Evaluated FPE cases preserve the configured character set and remain exactly reversible. Pseudonymization and mLDP for value-dependent values. The corpus’s naturally occurring value-dependent attributes,name, address,patient_name, are non-numeric. So, this path uses deter- ministic keyed pseudonymization, the same value mapping to the same pseudonym under a fixed key. No collisions were observed, though this is not a formal guarantee. A separate numeric mLDP path uses the Laplace mechanism with휀=1.0 under theℓ 1 metric, verified synthetically since no corpus attribute exercises it. Under the specified sensitivity and metric assumptions, the Laplace mech- anism provides the corresponding휀-DP guarantee. The privacy parameter is configurable to support deployment-specific privacy– utility trade-offs. Verified rewriting for contextual values. Contextual values are rewritten under a frozen prompt, each candidate checked by the pinned detector before acceptance, rejected and retried up to three times if at or above threshold before falling back to redaction. De- velopment found two failure modes. First, an early prompt caused the model to reproduce a protected field’s attribute name as filler, fixed by treating field names as non-output identifiers. Second, the detector can classify broader paraphrases as disclosures. For ex- ample, replacing pending harassment lawsuit with a pending legal matter scores 0.8≥ 휁. So, retries treat the detector as a conserva- tive gate rather than assuming natural paraphrase is safe. Since the rewriting model and judge are not independent, verification establishes only that outputs satisfy the pinned detector criterion, not independent semantic non-disclosure; the full evaluation also uses an exact-match backstop, accepting a rewrite only if it passes semantic verification and contains no literal protected value. This was introduced after full-scale evaluation found that literal echoes semantic verification alone admitted (§6.6). Redaction and fallback. Redaction serves as fallback when a transformation cannot be safely applied, FPE failing on format, pseudonymization or mLDP failing to produce a valid result, or rewriting exhausting its attempts. Each fallback’s source is recorded to distinguish transformation-specific failures from ordinary redac- tion. 6.5.2 Mechanism Verification. On the development sample (Ta- ble 19), all 103 transformed occurrences are classified as non- disclosing post-transformation (100% detector-based푃-removal), specific to the detector rather than proof of semantic non-disclosure. The sample comprises 18 FPE, 50 mLDP/pseudonymization, and 35 rewriting decisions; of the latter, 27 (77.1%) pass on the first attempt and 8 (22.9%) exhaust all three and fall back to redaction, with no second- or third-attempt successes. No FPE or pseudonymization fallbacks in this sample, and no FPE format-recognition fallback across the full 2,595-occurrence FPE population. Successful rewrites score 0.8 to 0.95 on a separate meaning-preservation evaluator, applied only to successful rewrites here and reported as supplemen- tary characterization rather than an end-to-end utility estimate. 6.5.3 Evaluation Protocol. All sanitizer components, thresholds, prompts, and policies are fixed using the 80-scenario development split. Evaluation uses all 405 held-out scenarios across six topology cells, yielding 2,430 scenario-cell runs and 34,884 protected-value occurrences. Since 105 scenarios share no common horizon with the rest of the corpus, each is evaluated at its canonical horizon where available, otherwise its shortest covered horizon, with no parameter re-tuned under this assignment. The implications of this horizon Sunday et al. Table 19: Transformation-layer verification on the development sample (푛=103). FPE checks combine 18 corpus-occurring and 27 synthetic cases; other rows are scoped to the indicated sample or corpus population. MetricResult Decided action: FPE / mLDP / rewrite18 / 50 / 35 Rewrite outcome: first-attempt clear / redaction fallback 27 (77.1%) / 8 (22.9%) Detector-based 푃 -removal103/103 (100%) FPE round-trip: corpus / synthetic18/18 + 27/27 FPE character-set preservation45/45 FPE length preservation41/45 Wrong-key recovery differs from original27/27 FPE format-recognition fallback (full corpus,푛= 2,595)0.0% Pseudonymization determinism / 푃 -removal50/50 mLDP (synthetic): 푃(|error| ≤ 10k)1.000 mLDP DP-inequality diagnostic23/24 allow passthrough (sampled)10/10 heterogeneity are discussed in §6.6.5. Leakage is measured using the same pinned three-tier detector throughout, so pre- and post- sanitization measurements share the same evaluation instrument. Authorization-anchored metrics. We report two authorization- conditioned metrics: residual leakage, the fraction of should-sanitize occurrences (푛=34,581) still accessible to an unauthorized recipi- ent after sanitization, and correct-allow, the fraction of should-allow occurrences (푛=303) still accessible to their authorized recipient. Lower residual leakage and higher correct-allow are preferable. Correct-allow measures authorized-disclosure retention, not gen- eral utility, anchored to authorization ground truth rather than task performance or content quality. We therefore separately re- port a content-level meaning-preservation proxy on a stratified 120-occurrence sample, with 40 per value type. Baselines. All conditions use identical held-out executions: None performs no sanitization, blanket redaction [30] redacts every de- tected value regardless of recipient, Presidio [25] applies fixed- infoType DLP detection followed by uniform redaction, and RE- CONS applies the proposed recipient-aware policy and type-aware transformation. Presidio serves as a reproducible open baseline for recipient-blind, fixed-type DLP. 6.6 RECONS Evaluation Table 20 summarizes the end-to-end results. RECONS reduces resid- ual leakage from 96.7% without sanitization to 29.25%, versus 28.3% for blanket redaction, while retaining 94.1% of authorized disclo- sures versus blanket redaction’s 20.5%, approaching blanket redac- tion’s leakage rate while retaining substantially more authorized disclosures. Presidio performs worse on both, 35.5% residual leakage and 34.7% correct-allow. Among the 395 held-out scenarios with no legitimately disclosable field, RECONS records 28.0% residual leak- age versus blanket redaction’s 28.4%, so the aggregate difference concentrates in the 10 scenarios with legitimately disclosable fields, where RECONS preserves an authorized disclosure that blanket redaction suppresses by design. 6.6.1 Sources of Residual Leakage. The decomposition localizes most residual cases to detection misses and recipient-unresolvable cases (Table 21). Of RECONS’s 10,116 residual cases, 9,657 (95.5%) Table 20: End-to-end results on the held-out set (405 scenarios; 2,430 scenario–cell runs; 34,884 protected-value occurrences). Residual leakage is lower-is-better; correct-allow is higher-is-better. ConditionResidual leakage↓Correct-allow↑ None96.7%0.0% Presidio (DLP)35.5%34.7% AgentLeak blanket redaction28.3%20.5% RECONS29.25%94.1% Table 21: Decomposition of RECONS’s 10,116 residual cases. Detec- tion misses dominate; field-level fallback is the principal RECONS- specific source. CauseCountShare Detection miss (never flagged)9,65795.5% Field-level fallback (no resolvable recipient)4524.5% Post-transformation detector-positive70.07% Total10,116100% Table 22: RECONS residual leakage by protected-value type. Con- textual values exhibit the highest residual exposure, consistent with weaker contextual detection. Value typeResidual leakage Value-dependent17.6% Format-dependent23.3% Contextual55.7% are undetected values that never reached the decision or transforma- tion layers. A further 452 (4.5%) are detected values with no resolv- able recipient on퐶 1 ,퐶 3 ,퐶 4 ,퐶 6 , or퐶 7 , using the field-level fallback, and seven cases (0.07% of residual cases, 0.02% of all should-sanitize occurrences) are sanitizer-acted content the evaluation detector still flags, examined individually in §6.6.4 as post-transformation detector-positive rather than confirmed disclosures. Detection coverage is thus the dominant source: 69.2% of should- sanitize occurrences were detected on the held-out set versus 66.7% recall on the development split (§6.3.5), populations that need not match. While detection recall does not directly predict residual leakage given that channel, authorization, and transformation also matter, the sanitizer plainly cannot act on an undetected value. The 452 fallback cases are a separate limitation, since unresolvable recipients preclude recipient-specific authorization. Thus, detec- tion coverage and recipient resolution address distinct sources of residual exposure. The value-type breakdown agrees (Table 22): residual leakage is 17.6% for value-dependent, 23.3% for format-dependent, and 55.7% for contextual values, the last consistent with contextual values’ lower detection recall (§6.3). 6.6.2 Channel-Level Disclosure. By channel (Figure 8),퐶 3 , struc- tured tool-call arguments, shows the highest residual leakage across conditions, consistent with lower structured-channel recall (§6.3) and field-level fallback for unresolvable퐶 3 recipients (§6.4). RE- CONS matches or improves on blanket redaction only on퐶 1 and퐶 2 (32.5% vs. 32.6%; 25.2% vs. 25.7%); elsewhere it trails:퐶 3 43.9% vs. 41.4%,퐶 4 26.5% vs. 24.1%,퐶 5 32.2% vs. 31.6%,퐶 6 19.8% vs. 17.4%,퐶 7 When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems C 1 C 2 C 3 C 4 C 5 C 6 C 7 Channel 0 20 40 60 % Residual Leakage 32.6 25.7 41.4 24.1 31.6 17.4 29.1 40.0 34.9 53.5 25.8 33.8 23.2 37.7 32.5 25.2 43.9 26.5 32.2 19.8 31.0 BlanketPresidioRECONS Figure 8: Residual leakage by observable channel.퐶 3 exhibits the highest residual leakage across the sanitizing conditions; RECONS trails blanket redaction on every channel except퐶 1 and퐶 2 . Table 23: Disclosure to topology-introduced agents before and after sanitization. ConditionCW-2 CW-7 P2P-4 P2P-7 P2P-10 Hier-7 None0% 98.0% 97.9% 98.0%97.6%97.8% Presidio [25]0% 34.2% 34.7% 35.1%35.8%35.0% Blanket Redaction [30]0% 26.7% 27.0% 25.5%25.9%26.5% RECONS0% 25.9% 26.9% 25.1%25.4%26.5% 31.0% vs. 29.1%. The largest gap is on퐶 3 , matching its concentration of unresolvable cases. 6.6.3 Topology Gradient Under Sanitization. Next, we evaluate whether RECONS reduces disclosure to the topology-introduced agents identified in §5.1. CW-2, with no topology-introduced agents, gives a 0% reference point. Across the five richer topologies (8,873 new-agent-recipient occurrences), unsanitized disclosure is 97.6– 98.0% versus RECONS’s 25.1–26.9% (Table 23). RECONS beats blan- ket redaction in four of five non-trivial cells and ties in Hier-7. Since topology-introduced agents are unauthorized under both, this does not isolate recipient-aware authorization’s contribution, which in- stead shows in authorized-disclosure retention (Table 20). Presidio leaves a higher residual floor, 34.2–35.8%, across these cells. 6.6.4 Ablation Analysis. Dynamic versus static authorization. Replacing recipient- aware authorization with a static allow-list raises residual leakage from 29.25% to 29.81%, 0.56 points, while raising correct-allow from 94.1% to 100%. The static policy preserves all legitimately allowed fields regardless of recipient. The two policies differ mainly on the 10 scenarios with legitimately disclosable fields, limiting the effective sample size of this comparison. Within this scope, the result is consistent with recipient awareness sharpening field- versus recipient-level authorization. Transformation menu versus redaction. Replacing the FPE, pseudonymization, and rewriting menu with uniform redaction under the same decisions changes residual leakage only marginally, from 29.25% to 29.59%, with correct-allow unchanged at 94.1%. Be- cause both conditions share authorization decisions, this result indicates that the transformation menu’s role is preserving autho- rized information and utility rather than lowering leakage itself. Transformation verification. At full scale, semantic-only rewrite verification admitted some literal copies of the protected value. So, we added an exact-match backstop requiring a rewrite to Table 24: Content-level meaning-preservation proxy by condition (stratified sample,푛=120; 40 per value type) and by value type for RECONS. The proxy does not fully characterize structured-field usability or task-level utility. ConditionUtility AgentLeak blanket redaction99.3% Presidio (DLP)97.3% RECONS (redact-only ablation)98.8% RECONS83.5% RECONS, by value type: Format-dependent (FPE)91.6% Value-dependent (pseudonym.)89.6% Contextual (rewrite / redact)69.1% pass semantic checking and contain no literal occurrence, falling back to redaction otherwise. This cut post-transformation detector- positive cases from 67 to 7, an 89.6% reduction. Of the seven re- maining cases, six involve negated true values, such as “no criminal history,” where rewrites contain no literal occurrence but the judge still classifies them as disclosures, reflecting reference-to-topic ver- sus disclosure-of-value. The seventh reflects disagreement between two calls to the same judge on identical, literal-value-free content, consistent with batched-inference non-determinism at temperature zero. None reflects literal reintroduction bypassing the exact-match backstop, though this establishes only that under this instrument, not immunity to semantic or inferential leakage. 6.6.5 Utility and Evaluation Limitations. Table 24 reports the content-level meaning-preservation proxy. The proxy assigns higher scores to blanket redaction (99.3%) than RECONS (83.5%), with the largest gap for contextual values (69.1%), possibly reflecting the proxy’s sensitivity to surface-form change: FPE and rewriting al- ter textual representations, while redaction can leave syntactically coherent output despite removing information. RECONS scores higher for format-dependent (91.6%) and value-dependent (89.6%) values, where FPE and pseudonymization apply. Since the proxy does not directly measure structured-field usability or task-level utility, we do not read the 99.3% versus 83.5% gap as evidence of greater practical utility for blanket redaction; correct-allow remains the primary retention measure, being directly anchored to ground- truth authorization labels. Overall, recipient-aware sanitization approaches blanket redac- tion’s residual-leakage performance while substantially increasing authorized-disclosure retention. The dominant remaining limita- tion is detection coverage, particularly for contextual values, with recipient resolution a separate limitation of the current policy. 7 Discussion and Limitations 7.1 Design Implications Our findings suggest privacy protection in MALS cannot be de- signed from static architectural assumptions and must instead be enforced against the realized recipient and execution path at run- time. The evidence supports three bounded conclusions: topology changes protected-value recipient exposure; recipient-conditioned enforcement improves the privacy–authorization trade-off rela- tive to blanket redaction; and detection coverage is the principal Sunday et al. remaining bottleneck, with recipient resolution a secondary bound- ary. The rest of this section develops each in turn with its bounding limitations. Topology as a security-relevant configuration. Topology- driven exposure (§5.1) is not an artifact a better detector or im- plementation would remove but a structural consequence of which agents a communication graph makes reachable. Surface leakage varies—whether a value is disclosed at all—by only 2.2 points across six cells, while new-agent disclosure—whether that value reaches a recipient the topology introduces—rises from a structural 0% to 52.2% over the same cells. So topology belongs in a system’s security configuration alongside access control, not only performance or scalability planning. We claim no universal topology law: ranking among richer topologies is unstable across frameworks and models (§5.6, §5.7), and no one topology, hierarchical delegation included, is asserted as intrinsically riskier. What generalizes is that richer topology creates exposure a simpler one structurally cannot, not its magnitude or ordering. Recipient Conditioning as the Key Design Principle. RECONS’s decision layer implements one conditional rule, unauthorized→ sanitize, authorized→ allow, the entire mech- anism separating recipient-conditioned from recipient-blind en- forcement applied to the same detected value. Its advantage is not dramatically lower leakage; RECONS’s residual 29.25% sits close to blanket redaction’s 28.3% since both discard topology- introduced disclosure identically. The advantage is selective en- forcement, which retains 94.1% of authorized disclosures against 20.5% by permitting exactly what a recipient-blind policy cannot dis- tinguish from a violation. Recipient conditioning should be judged on what it preserves, not how far it lowers an already detection- bounded rate. This comparison rests on a modest base, only 303 should-allow occurrences, with the RECONS-versus-blanket differ- ence concentrated in just 10 of 405 scenarios containing a legiti- mately disclosable field, so the 94.1% versus 20.5% gap should be read as consistent with the underlying behavior rather than as a precise population estimate. Detection as the Principal Bottleneck. The RECONS pipeline’s detect-decide-transform structure means transformation can only apply to a value the detector already flagged: an undetected value never reaches the decision layer and passes through unchanged re- gardless of transformation sophistication. This is architectural, not correlational: 95.5% of end-to-end residual leakage (§6.6.1) traces to exactly this: disclosures never flagged, concentrated in contextual attributes with the weakest semantic recall, a ceiling any same- detector sanitizer, blanket redaction included, would share, since neither can act on what neither sees. Only improved detection, not decision or transformation refinement, recovers this loss. Recipient Resolution as an Architectural Boundary. Recipient- aware authorization presupposes a resolvable recipient.퐶 2 mes- sages and퐶 5 reads satisfy this directly;퐶 3 tool-call arguments target a tool, not an agent, so 95.8% of퐶 3 events are self-loops crossing no inter-agent boundary, with the remaining 4.2% reaching another agent via an already-covered퐶 5 read. Hence, field-level fallback on퐶 3 is correct given the channel’s structure, not a coverage gap. Extending recipient resolution to the small residual of genuinely tool-mediated disclosure would require richer provenance than call-and-response. Specifically, tracking which agent consumes a tool’s output when not itself a logged퐶 5 read, and communication semantics that treat a tool’s result as attributable to whichever agent next acts on it. Absent that provenance, recipient resolution cannot be extended to this channel without inventing a recipient the trace does not evidence. Horizon Heterogeneity. Each scenario is evaluated at its shortest available horizon (§4.1), unevenly across domains: 105 scenarios lack a horizon common to the rest, and even fully-covered domains skew, finance and healthcare almost entirely at푇 1 , legal predom- inantly at푇 3 or longer. So, cross-domain comparisons here are confounded with horizon length and should not be read as horizon- controlled domain estimates. 7.2 Threat-Model Limitations Our threat model, and consequently every result in this paper, explicitly inherits the following limitations: • Corpus and generalization scope: experiments derive from an English-language, four-domain subset of one public bench- mark [30], with one generator and framework as the primary configuration; cross-model and cross-framework checks cover a handful of additional systems each, showing findings are not artifacts of one system but not that they generalize beyond those tested. •Latent-state leakage: a value influencing a model’s later output through its own internal context or reasoning state rather than an explicit channel event. Hence, it cannot be detected, attributed to a recipient, or evaluated by a trace-based methodology like ours. •Stronger collusion: unauthorized recipients pooling their indi- vidual observations. • Cross-session inference: an adversary correlating evidence across independent executions rather than within one trace. •Unobserved side channels: any channel beyond the seven instrumented (퐶 1 –퐶 7 ). •Attacks outside the evaluated threat model: reconstruction from indirect evidence and behavioral side-channels, tested di- rectly with no confirmed instance found (§5.3, §5.4), though this does not establish absence under a more capable or adaptive adversary. 8 Conclusion We investigated privacy leakage in multi-agent LLM systems as a question of where a protected value travels, not only whether it is disclosed. Across six topology cells, topology changes recipient exposure rather than overall disclosure incidence, rising from 0% to 52.2% while surface leakage moves only 2.2 points, holding when replicated across additional models and frameworks. In a separate experiment holding topology fixed, framework choice alone pro- duced a further two-orders-of-magnitude spread, demonstrating that architecture, not just communication structure, drives expo- sure. Exhaustive testing across three reconstruction axes and a behavioral side-channel found no confirmed leakage beyond di- rect disclosure and its propagation, confirming this is where these systems actually leak, not a scope chosen for convenience. We ad- dressed this with RECONS, an inline Detect→Decide→Trans- form sanitizer conditioning enforcement on recipient rather than When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems sensitivity alone, reducing residual disclosure to within one point of blanket redaction (29.25% versus 28.3%) while retaining 4.6×as many authorized disclosures (94.1% versus 20.5%), showing that suppressing unauthorized disclosure need not suppress what policy already permits. Detection, not recipient resolution, is the binding constraint: 95.5% of residual cases are values no same-detector sanitizer could act on, a limitation any comparable system shares, while only 4.5% trace to RECONS’s own resolution step. Recipient-conditioned en- forcement is therefore necessary but not sufficient; closing the gap depends more on detection coverage, particularly for contextual attributes, than on refining the decision layer. More broadly, privacy controls for multi-agent LLM systems cannot be assessed or built from static topology, framework, or model assumptions; they must act on the recipient and communication path realized at runtime. References [1][n. d.]. Agent Development Kit | Gemini Enterprise Agent Platform. https: //docs.cloud.google.com/gemini-enterprise-agent-platform/build/adk [2] [n. d.]. CrewAI. https://crewai.com [3] [n. d.]. OpenAI Agents SDK. https://openai.github.io/openai-agents-python/ [4] Sadia Asif and Mohammad Mohammadi Amiri. 2026. Information-Theoretic Pri- vacy Control for Sequential Multi-Agent LLM Systems. arXiv:2603.05520 [cs.MA] https://arxiv.org/abs/2603.05520 [5]Milon Biswas, Wei Yu, Qianlong Wang, and Weixian Liao. 2025. Quantifying Privacy Leakage in Multi-Agent LLMs: A Unified Theoretical and Empirical Analysis. In 2025 IEEE International Conference on Big Data (BigData). 1685–1694. doi:10.1109/BigData66926.2025.11401523 [6] Amrita Roy Chowdhury, David Glukhov, Divyam Anshumaan, Prasad Chalasani, Nicolas Papernot, Somesh Jha, and Mihir Bellare. 2025. Pr휖mpt: Sanitizing Sensitive Prompts for LLMs. arXiv:2504.05147 [cs.CR] https://arxiv.org/abs/2504. 05147 [7] Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russi- novich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella- Béguelin. 2025.Securing AI Agents with Information-Flow Control. arXiv:2505.23643 [cs.CR] https://arxiv.org/abs/2505.23643 [8]Hugo García Cuesta, Pablo Mateo Torrejón, and Alfonso Sánchez-Macián. 2026. Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models. arXiv:2607.08282 [cs.CR] https://arxiv.org/ abs/2607.08282 [9]Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37. Curran Associates, Inc., 82895–82920. doi:10.52202/079017-2636 [10] Diego Gosmar and Deborah A. Dahl. 2025. Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems. arXiv:2509.14956 [cs.AI] https: //arxiv.org/abs/2509.14956 [11]Shuang Guo and Zihui Li. 2025.SRPG: Semantically Reconstructed Pri- vacy Guard for Zero-Trust Privacy in Educational Multi-Agent Systems. arXiv:2512.03694 [cs.MA] https://arxiv.org/abs/2512.03694 [12]Gurusha Juneja, Jayanth Naga Sai Pasupulati, Alon Albalak, Wenyue Hua, and William Yang Wang. 2025. MAGPIE: A benchmark for Multi-AGent contextual PrIvacy Evaluation. arXiv:2510.15186 [cs.CR] https://arxiv.org/abs/2510.15186 [13]Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient Memory Management for Large Language Model Serving with PagedAtten- tion. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles. [14] LangChain, Inc. 2022. LangChain: the open agent platform to own your intelli- gence. https://w.langchain.com. Accessed: 2026-09-07. [15]LangChain, Inc. 2024. LangGraph: agent orchestration framework for reliable AI Agents. https://w.langchain.com/langgraph. Accessed: 2026-09-07. [16]Wenkai Li, Liwen Sun, Zhenxiang Guan, Xuhui Zhou, and Maarten Sap. 2025. 1-2-3 Check: Enhancing Contextual Privacy in LLM via Multi-Agent Reasoning. In LLMSEC, Leon Derczynski, Jekaterina Novikova, and Muhao Chen (Eds.). ACL. https://aclanthology.org/2025.llmsec-1.9/ [17]Yuchen Ling, Shengcheng Yu, Zhenyu Chen, and Chunrong Fang. 2026. To- ward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation. arXiv:2606.10749 [cs.CR] https://arxiv.org/abs/2606.10749 [18] Jinbo Liu, Defu Cao, Yifei Wei, Tianyao Su, Yuan Liang, Yushun Dong, Yan Liu, Yue Zhao, and Xiyang Hu. 2026. Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs. In Findings of the Association for Computational Linguistics: ACL 2026, Maria Liakata, Viviane P. Moreira, Jiajun Zhang, and David Jurgens (Eds.). Association for Computational Linguistics, San Diego, California, United States, 39728–39746. doi:10.18653/v1/2026.findings-acl.1980 [19]Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, Shudan Zhang, Xiang Deng, Aohan Zeng, Zhengxiao Du, Chenhui Zhang, Sheng Shen, Tianjun Zhang, Yu Su, Huan Sun, Minlie Huang, Yuxiao Dong, and Jie Tang. 2025. AgentBench: Evaluating LLMs as Agents. arXiv:2308.03688 [cs.AI] https://arxiv.org/abs/2308.03688 [20]Jiaqi Luo, Songyang Peng, Jiarun Dai, Zhile Chen, Zhuoxiang Shen, Geng Hong, Xudong Pan, Yuan Zhang, and Min Yang. 2026.AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent. arXiv:2605.28071 [cs.CR] https://arxiv.org/abs/2605.28071 [21]Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. 2024.Can LLMs Keep a Se- cret? Testing Privacy Implications of Language Models via Contextual Integrity Theory. In International Conference on Learning Representations, B. Kim, Y. Yue, S. Chaudhuri, K. Fragkiadaki, M. Khan, and Y. Sun (Eds.), Vol. 2024. 1892–1915. https://proceedings.iclr.c/paper_files/paper/2024/file/ 08305d8b2ddab98932c163ea73df065f-Paper-Conference.pdf [22]Vaidehi Patil, Elias Stengel-Eskin, and Mohit Bansal. 2025. The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration. arXiv:2509.14284 [cs.CR] https://arxiv.org/abs/2509.14284 [23] run-llama. [n. d.]. GitHub - run-llama/llama_index: LlamaIndex is the leading document agent and OCR platform. https://github.com/run-llama/llama_index [24]sophialagerkranspandey. [n. d.]. Introduction to Semantic Kernel. https://learn. microsoft.com/en-us/semantic-kernel/overview/ [25]Data Privacy Stack. [n. d.]. Index - Presidio. https://presidio.dataprivacystack. org/ [26]Khanh-Tung Tran, Dung Dao, Minh-Duong Nguyen, Quoc-Viet Pham, Barry O’Sullivan, and Hoang D. Nguyen. 2025. Multi-Agent Collaboration Mechanisms: A Survey of LLMs. arXiv:2501.06322 [cs.AI] https://arxiv.org/abs/2501.06322 [27] Sanidhya Vijayvargiya, Aditya Bharat Soni, Xuhui Zhou, Zora Zhiruo Wang, Nouha Dziri, Graham Neubig, and Maarten Sap. 2025. OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety. doi:10. 48550/arXiv.2507.06134 [28] Shouju Wang, Fenglin Yu, Xirui Liu, Xiaoting Qin, Jue Zhang, Qingwei Lin, Dongmei Zhang, and Saravan Rajmohan. 2025. Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents. In EMNLP, Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng (Eds.). [29] Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W White, Doug Burger, and Chi Wang. 2023. AutoGen: Enabling Next- Gen LLM Applications via Multi-Agent Conversation. arXiv:2308.08155 [cs.AI] https://arxiv.org/abs/2308.08155 [30] Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. 2026. AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems. IEEE Access 14 (2026), 94960–94978. [31] Hailong Yang, Renhuo Zhao, Guanjin Wang, and Zhaohong Deng. 2025. GAMA: A General Anonymizing Multi-Agent System for Privacy Preservation Enhanced by Domain Rules and Disproof Mechanism. arXiv:2509.10018 [cs.AI] https: //arxiv.org/abs/2509.10018 [32]Urchade Zaratiana, Nadi Tomeh, Pierre Holat, and Thierry Charnois. 2024. GLiNER: Generalist Model for Named Entity Recognition using Bidirectional Transformer. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), Kevin Duh, Helena Gomez, and Steven Bethard (Eds.). Association for Computational Linguistics, Mexico City, Mexico, 5364–5376. doi:10.18653/v1/2024.naacl-long.300 [33]Xueqiang Zhang, Xiaofei Dong, Yiru Wang, Dan Zhang, and Feng Cao. 2025. A Survey of Multi-AI Agent Collaboration: Theories, Technologies and Applica- tions (DEAI ’25). Association for Computing Machinery, New York, NY, USA, 1875–1881. doi:10.1145/3745238.3745531 Sunday et al. A Appendix Table 25: Interaction archetypes used in trajectory construction. ArchetypeWorking definition BASE (initial task)The trajectory’s opening turn, in which the acting agent is given the task and the protected value. A (elaboration)A turn adding detail or context to a prior state- ment, without being directly asked to confirm or reveal the protected value. B (handoff )A turn transferring the task, case, or context to another agent. C (justification) A turn explaining or defending a decision or rec- ommendation. D (error handling)A turn responding to or correcting a mistake or inconsistency earlier in the trajectory. E (closeout)A turn concluding the trajectory or interaction, e.g. summarizing the outcome. F (rapport)A turn oriented toward social or relational ex- change rather than task content. G (confirmation probe)A turn in which one agent asks another to confirm, deny, or restate a specific candidate value, directly soliciting disclosure if the candidate is correct. Table 26: Gemini-3.7-Flash Hier-7 disclosure rates by protected at- tribute type. Structured identifiers exhibit lower observed disclosure rates than contextual and narrative attributes. AttributeDisclosure rate SSN / DOB / phone / email / account0.0% Salary / balance / credit score0.0% Address0.9% Settlement amount3.7% Confidential strategy27.6% Internal notes36.4% Criminal history63.6%