Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs

Agam Goyal; Eshwar Chandrasekharan; Hari Sundaram; Yian Wang

REVIEW

Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs

Yian Wang, Agam Goyal, Eshwar Chandrasekharan, Hari Sundaram

Artificial Intelligence · Submitted 29 Aug 2026 · 2 references

Pith's verdict: Solid evidence for a real privacy failure mode in multi-agent LLM handoffs; the core qualitative pattern is robust even if the exact magnitudes may shift under independent measurement.

T0 · AI review

How this review was made: An AI referee (deepseek/deepseek-v4-flash) read the paper on September 9, 2026 and answered a fixed list of questions about it. T0 is the starting level every paper gets. The levels describe how deeply Pith has checked the paper, never the authors.

T0 AI review An AI read the paper and answered a fixed list of questions.
T1 Audit Automatic checks that the references and files the paper relies on exist and match.
T2 Compute The paper's code or calculations re-run with the same results.
T3 Formal statement The claims written out in a formal math language a computer can read.
T4 Proof Those claims proved, and the proof checked by computer.

How Pith checks papers →

· 2 major objections · 11 minor · Ask about this paper · The compiled record · Read the full review →

Challenge this review Comment (0) Read on arXiv ↗

Cite ▾

arXiv ID2608.29028 (version 1)

Pith ID3JVQA4ZC, Pith's permanent record of this paper and its review

CitationAgam Goyal, Eshwar Chandrasekharan, Hari Sundaram, Yian Wang. "Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs." arXiv:2608.29028 (2026). https://pith.science/paper/3JVQA4ZC

Cite this reviewBibTeX for Pith's review of this paper

Claim paper

Why Pith says this

Highlight any text to comment on it.

Editor's note

read the letter

You should know that this paper makes a clean empirical case that multi-agent LLM handoffs preferentially strip boundary metadata while preserving operational facts, and that marker explicitness causally controls downstream leakage. The core finding—that summary collapse is a structural privacy failure mode at the handoff artifact level—is likely real and important for the growing deployment of multi-agent systems.

What it does well: the experimental design is thorough, spanning three model families, controlled conditions, human validation (κ=0.74), multiple sensitivity checks, and a causal marker-strength experiment (E8) that holds content constant while varying only the marker language. The ordinal label proportions and scenario-stratified CMH tests strengthen the case beyond the numeric σb/σop averages. The paper is also honest about its limitations, including the need for production-traces validation and the gold-label nature of the allowlist mitigation.

The soft spot is the one the stress-test note hits: the central σb and σop scores are produced by a single GPT-5.5 Thinking judge whose prompt encodes the paper's own boundary-vs-fact distinction. The human validation used the same rubric from two of the authors, so shared construct bias is not ruled out. The PrivacyLens replication uses the identical frozen judge, so while it validates reproducibility across datasets, it does not validate construct independence. The ordinal proportions and CMH tests on the "absent vs not absent" binary are less vulnerable to weighting choices, but they still rely on the judge's classification of what counts as a missing marker.

This concern doesn't sink the paper. The qualitative decoupling pattern—markers drop much faster than facts, vague hedges leak while explicit constraints protect—is robust across multiple experiments and models. Even if an independent judge shifted absolute σb values, the relative pattern and the L1→L2 dose-response would likely hold. But the magnitudes in Table 2 and the quadrant counts should be read as upper bounds until independently rescored.

Who this is for: researchers building or auditing multi-agent pipelines where handoff compression is used (scheduling, care coordination, finance). Practitioners will get concrete design guidance (typed audience fields over prose instructions).

Recommendation: This paper deserves a serious referee. Send it to peer review. The judge-bias concern should be flagged for reviewers, but it does not warrant desk rejection—the contribution is important and the evidence base is strong enough to warrant community scrutiny.

Referee report

Significance

The paper's core idea—moving the privacy unit of analysis from the downstream agent's decision to the intermediate handoff artifact—is genuinely differentiated from the single-agent contextual-integrity benchmarks it cites, and if the measurements hold it has direct engineering consequences (typed, machine-actionable boundary fields in handoff schemas). The experimental discipline is a real strength and should be credited: three model families with held-out open replicas; a 720-cell design matrix with a documented stratified sample; scenario-level bootstrap CIs; pinned-package reproducible statistics; two leakage detectors with opposite bias directions; manual audits that revise leak counts upward when heuristics under-count; external annotators on E7 analyzed conservatively (dual-agreement floor, unresolved disputes retained as unresolved); and a cross-dataset replication on PrivacyLens that is transparent about its weaker σop grounding. The paper also reports its own controls honestly, including the negative role-label manipulation, the null three-hop full-replay result, and the E5 single-agent control.

Major objections (2)

[4.4 / B.4; Tables 2–3] The decoupling that anchors the paper's headline claim is measured by a single GPT-5.5 Thinking judge whose rubric embeds the authors' boundary-versus-fact construct (the Appendix B.4 definition list of 'instructions, caveats, constraints, uncertainty markers, audience limits, ownership limits, or privacy limits') and which explicitly instructs that a handoff softening a hard marker to 'use discretion' be scored 'weakened.' The reported human validation (κ=0.74, accuracy 0.92) was produced by the two authors applying that same rubric, as the Limitations section candidly concedes, and the PrivacyLens replication in Section E reuses the same frozen judge, so it establishes stability of the judge-scenario pipeline rather than independence of the construct. Because hard compression shortens every handoff, a marker-primed judge could systematically rate compression-related shortening as weakened or absent even when the governing restriction remains inferable or is present in shorter paraphrase; if so, the σb-σop gaps in Table 2, the absent mass in Table 3, and the CMH odds ratios in Table 22 would all be inflated in the same direction. This concern does not touch the leakage-based experiments (E3/E4/E8 rest on the exact/alias detector, a separately calibrated semantic judge, and manual audit, with the E8 gradient replicated on all three models), so the causal role of marker strength survives even a biased survival judge; what is at stake is the magnitude and construct purity of the decoupling itself. I request (i) an external annotation pass on a stratified E1/E2 sample using a plain-language 'is this restriction present in the handoff' question posed without the paper's construct definitions, and (ii) per-handoff behavioral grounding showing that judge-scored-absent markers predict downstream behavior on the same artifacts (the analysis requested in Major Comment 2 would supply this).
[5.1–5.2; E2 vs. E3/E4/E8] The abstract's causal framing ('this handoff step is a structural source of privacy leakage') is composed from two designs that never meet on the same artifacts. E1/E2 show that compression lowers judge-scored σb while σop holds near ceiling; E3/E4/E8 show that handoffs constructed without an effective marker leak downstream (48/48 and 37/48 for no-marker; 44/48 and 38/48 for 'use discretion') while constructed explicit-marker handoffs rarely leak. The actual compressed handoffs of E2, including those with 25–39% of markers scored absent in Table 3, are never run through the downstream leakage probes, and no reported analysis regresses per-handoff leakage on per-handoff σb; the three-hop study is the only design in which generated handoff artifacts reach downstream agents, and there final leakage is non-monotonic across only 12 scenarios. As it stands, the link 'compression lowers σb' plus 'low σb leaks' is an informal inference across experiments rather than a direct measurement. Please either add a matched experiment that feeds free-text and 25-word E2 handoffs on the same scenarios into the E3/E4 downstream probes and reports leakage as a function of σb (which would also validate the survival measure behaviorally), or explicitly rephrase the abstract and Section 5 to present the two results as complementary but separately demonstrated.

Minor objections (11)

[Abstract, 5.2] The headline numbers 'σb≈0.80', 'σb≈0.57', and 'under 15%' mix models and detectors; attribute them explicitly (0.781 is the DeepSeek free_text value, 0.557 is the Qwen 25-word value, and the E8 GPT-5-mini L3 cell reaches 8/48 ≈ 17% under the semantic judge, above the stated 15%).
[C.1–C.2, Tables 8/15] The baseline trajectory is non-monotonic in a way the main text does not acknowledge: DeepSeek-R1-32B free_text σb (0.781) is below its compressed_free_text (0.885), and GPT-5-mini's 40-word cap (0.919) is essentially unchanged from compressed_free_text (0.916) before the sharp drop at 25 words; a sentence in Section 5.1 explaining that mild caps do not reduce σb (and that DeepSeek drops markers even in uncompressed free text) would strengthen the selectivity claim.
[5.1, C.4] With σop near ceiling, the handoff-level Pearson r has almost no variance to correlate, so the near-zero values are weakly informative; the quadrant counts (7/180 and 26/180) and the CMH odds ratios are the informative statistics, so consider presenting those as primary and describing r as auxiliary.
[Table 2] The 'Flagship' row model identity is not disclosed, but the row underpins the claim that summary collapse is not an artifact of small or distilled models; identify the model or justify withholding the identity.
[4.4, B.4] The survival judge is GPT-5.5 Thinking while one of the evaluated pipelines is GPT-5-mini; cross-model σb comparisons (e.g., GPT baseline 0.954 versus DeepSeek 0.880) may include an in-family evaluator preference, which should be acknowledged or tested.
[5.3, Table 19, C.12] The E9-versus-E6 comparison pools 48 downstream prompts against 288 across different handoff-generation protocols; the within-E9 no-marker controls (43/48 and 39/48 for the primary models, 36/48 for the Qwen column of Table 32) are the cleaner baselines, and the text's '36/48 no-marker control' should say which model's control is meant.
[5.2, C.8] The sentence that the no-handoff direct-full-marker condition 'leaks more often than the operationalized handoff' compares E5 with E3 across conditions that differ in marker operationalization; the control's clean evidence is that single-agent direct access with strong markers still leaks (20/48 GPT, 11/48 DeepSeek), so rephrase the comparison accordingly.
[Tables 4–5, 23–26, 31–32] Label each table or column with the detector that produced it; in particular, the E6 counts (58/288 and 42/288) are not identified as exact/alias-only, and if they are, the paper should state that they undercount paraphrase leakage, a conservative direction for its claim.
[5.3] Report per-hop σb and per-hop leakage for the three-hop study in a table; the text currently gives only the hop-1→hop-3 paired differences, and the non-monotonicity claim is otherwise uncheckable against the released data.
[4.4] Specify which model and threshold define the calibrated semantic judge; the text describes its calibration on human-labeled E3 data but does not name the model.
[2] Fix the grammar slip in the CPM paragraph, where a standalone period interrupts the sentence ('We follow Petronio (2002) specifically. whose rule-management heuristics...').

How Pith checks papers → · Full audit of this paper →

The paper

The paper claims

Multi-agent LLM handoffs suffer from 'summary collapse': operational facts survive compression while the privacy rules that limit their use are weakened or dropped, causing systematic downstream leakage.

The reading

The paper identifies a structural privacy failure in multi-agent LLM systems: when one agent compresses an upstream interaction into a handoff artifact for a downstream agent, the summary preferentially preserves the operational facts the next agent needs while weakening or dropping the boundary metadata that governed how those facts could be used. The authors call this selective loss "summary collapse" and measure it with two survival scores—boundary-marker survival (σ_b) and operational-fact survival (σ_op)—showing they decouple under compression, especially under tight token budgets. Controlled experiments demonstrate that the strength of the boundary marker (vague hedges vs. explicit constraints) causally determines whether leaked content appears in audience-facing outputs, and that typed, machine-readable audience allowlists suppress leakage almost entirely when correctly populated. The work moves the privacy question from a single agent's decision to the artifact passed between agents, arguing that the real leak happens upstream of the final output.

What carries the argument

The key mechanism is the decoupling of boundary-marker survival (σ_b) from operational-fact survival (σ_op) during handoff compression, quantified via a human-validated LLM judge (κ=0.74). The central causal chain is marker strength: a five-level gradient from no marker to hard imperative shows a sharp drop in leakage at the transition from vague hedge to soft suggestion (L1→L2), indicating that the marker must be readable as an operational instruction, not merely privacy-sounding language. The typed audience-allowlist schema operationalizes the boundary as a machine-actionable constraint, which nearly eliminates leakage when correctly populated.

Extended reading notes

Core claim

The central discovery is that handoff compression in multi-agent LLM systems systematically discards the rules that constrain sensitive information while preserving the information itself, a failure mode termed summary collapse. Using a custom testbed (BOUND-HANDOFF) of 36 scenarios across seven domains, the authors show that boundary-marker survival (σ_b) and operational-fact survival (σ_op) are nearly uncorrelated at the individual-handoff level, and a substantial fraction of handoffs land in the low-σ_b, high-σ_op quadrant. The decoupling widens under hard compression (e.g., a 25-word budget reduces σ_b to approximately 0.57 while σ_op stays above 0.97). Through matched downstream tests, they prove that marker explicitness—not mere presence—is the causal determinant of leakage: vague language like "use discretion" leaks in 73% of GPT-5-mini cases, whereas explicit constraints reduce leakage to under 15%. A gold-derived typed audience-allowlist schema eliminates leakage on two primary models, but only when the boundary field is correct; a corrupted allowlist restores leakage to near no-marker levels.

Load-bearing premise

The experimental scenarios, though spanning seven domains and independently replicated on PrivacyLens, are hand-authored and semi-synthetic; the load-bearing premise is that the decoupling of σ_b and σ_op and the causal role of marker strength generalize to production multi-agent systems with real users, long-lived memory, and natural boundary-marking language.

Editorial extensions

If this is right

Multi-agent system designers should encode privacy boundaries as typed fields (e.g., allowed_audiences) rather than rely on natural-language prompts, as the latter are stripped by compression.
Privacy evaluation in multi-agent systems must measure handoff artifacts, not just final outputs, because boundary loss occurs upstream and may be hidden by later information loss.
The marker-strength gradient provides a design principle: vague hedges are functionally equivalent to no marker for leakage risk; only explicit, instruction-like constraints offer meaningful protection.
Boundary extraction becomes a bottleneck: systems need automated, paraphrase-robust validation of boundary fields with confidence scoring and abstention mechanisms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The selective loss pattern may generalize beyond handoff compression to any LLM summarization or memory retrieval task where operational content competes with meta-constraints, suggesting a broader vulnerability in agentic systems.
The typed allowlist approach, while effective in the controlled setting, requires accurate extraction of boundaries from upstream dialogue, which is itself an open problem that could introduce new failure modes (e.g., extraction errors amplifying leakage).
Cross-cultural or multilingual deployments may require recalibrating the marker-strength gradient, as politeness conventions differ across languages.

Original abstract

Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \emph{summary collapse}. On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge ($\kappa = 0.74$), where $\sigma_b = 1$ means every boundary marker survives verbatim and $\sigma_b = 0$ means all are lost. Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson $r$ near zero): uncompressed free-text handoffs preserve boundaries at $\sigma_b \approx 0.80$, whereas a $25$-word budget drops $\sigma_b$ to ${\approx}0.57$ while operational-fact survival stays near ceiling. Controlled downstream tests reveal that protection depends on \emph{boundary explicitness}: vague languages leak in $73\%$ of GPT and $50\%$ of DeepSeek cases, while explicit constraints reduce leakage to under $15\%$ across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.

The compiled record

The paper's own sentences, arranged, kept beside the review and separate from it. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 6,083 input tokens.

What the abstract itself states, as probabilities: claims first 0.05 · states limitation 0.35 · human participants 0.53 · controlled comparison 0.98 · randomized assignment 0.04 · states quantitative result 0.99 · compares with prior results 0.91 · mentions code or data availability 0.03.

The abstract, sentence by sentence

arXiv listing abstract v1. Results and the main claim are underlined; show every role.

Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \emph{summary collapse}. On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge ($\kappa = 0.74$), where $\sigma_b = 1$ means every boundary marker survives verbatim and $\sigma_b = 0$ means all are lost. Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson $r$ near zero): uncompressed free-text handoffs preserve boundaries at $\sigma_b \approx 0.80$, whereas a $25$-word budget drops $\sigma_b$ to ${\approx}0.57$ while operational-fact survival stays near ceiling. Controlled downstream tests reveal that protection depends on \emph{boundary explicitness}: vague languages leak in $73\%$ of GPT and $50\%$ of DeepSeek cases, while explicit constraints reduce leakage to under $15\%$ across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#	sentence	role	the authors' own work	states the main conclusion	strength
s0	Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state.	background 1.00	0.06	0.03	asserted 0.87
s1	We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used---a failure mode we call \emph{summary collapse}.	contribution 0.53	0.89	0.92	asserted 1.00
s2	On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge ($\kappa = 0.74$), where $\sigma_b = 1$ means every boundary marker survives verbatim and $\sigma_b = 0$ means all are lost.	method 0.98	0.96	0.06	asserted 0.97
s3	Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson $r$ near zero): uncompressed free-text handoffs preserve boundaries at $\sigma_b \approx 0.80$, whereas a $25$-word budget drops $\sigma_b$ to ${\approx}0.57$ while operational-fact survival stays near ceiling.	result 1.00	0.96	0.19	asserted 1.00
s4	Controlled downstream tests reveal that protection depends on \emph{boundary explicitness}: vague languages leak in $73\%$ of GPT and $50\%$ of DeepSeek cases, while explicit constraints reduce leakage to under $15\%$ across all three tested models.	result 1.00	0.94	0.14	asserted 1.00
s5	A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff.	result 0.90	0.94	0.05	asserted 1.00
s6	Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.	result 0.67	0.91	0.45	asserted 1.00

What kind of paper the classifier reports this is: empirical study 1.00 · evidence from observation or experiment 0.99.

What was examined, and what was not

sources read

arXiv listing abstract v1

not examined

full text
figures and tables
references and citing sentences
relations to other papers

levels run

P abstract

not run

S sections
T body sentences
C citations
R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

Figures

**Figure 1.** Summary collapse. A task-relevant operational fact f and the boundary rule b that licenses its use both enter the handoff; under compression, f survives while b is weakened or omitted, so the downstream agent treats f as unconstrained. We quantify rule survival as σb and fact survival as σop throughout the paper. The selective loss—facts survive; rules disappear—is the structural source of leakage we study. that time,” they share just enough—the slot is unavailable—while withholding the therapy appointment, the job interview, or the court hearing. This selective disclosure is the…

**Figure 2.** Privacy–utility frontier under graded audience

Figures reproduced from arXiv:2608.29028 by the authors.

References

Works cited (2)

[2]

Openai gpt-5 system card.arXiv preprint arXiv:2601.03267. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. 2025a. Unveiling privacy risks in llm agent memory. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 25241–25260. Liwen Wang, Wenxuan Wang, S...

View on Pith Pith review arXiv 2026
[2025]

The sum leaks more than its parts: Compo- sitional privacy risks and mitigations in multi-agent collaboration.arXiv preprint arXiv:2509.14284. Sandra Petronio. 1991. Communication boundary man- agement: A theoretical model of managing disclo- sure of private information between marital couples. Communication theory, 1(4):311–335. Sandra Petronio. 2002.Bou...

View on Pith arXiv 1991

How the literature uses it

What this paper does with the arXiv papers it cites

Each citing sentence is taken from the citing paper's LaTeX source and typed by Pith's classifier. A label appears at probability 0.8 or more (0.95 for support), a contest at 0.7 or more; the quoted words are the citing authors'. How each label was checked · JSON

What it cites · 3 sentences without a confident label

Uses the method or tool of 4 papers

GPT-5-mini [ref] and DeepSeek-R1-32B [ref] are the two primary models on which every experiment is run; Qwen3-32B [ref] is included as a targeted third-model replication, covering the four experiments where cross-pipeline robustness is essential for the headline claims: E1 baseline handoff survival, E2 compression stress, E8 marker-strength gradient, and the E9 corrupted-allowlist stress test.

DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning · Models · 0.83
GPT-5-mini [ref] and DeepSeek-R1-32B [ref] are the two primary models on which every experiment is run; Qwen3-32B [ref] is included as a targeted third-model replication, covering the four experiments where cross-pipeline robustness is essential for the headline claims: E1 baseline handoff survival, E2 compression stress, E8 marker-strength gradient, and the E9 corrupted-allowlist stress test.

Qwen3 Technical Report · Models · 0.83
GPT-5-mini [ref] and DeepSeek-R1-32B [ref] are the two primary models on which every experiment is run; Qwen3-32B [ref] is included as a targeted third-model replication, covering the four experiments where cross-pipeline robustness is essential for the headline claims: E1 baseline handoff survival, E2 compression stress, E8 marker-strength gradient, and the E9 corrupted-allowlist stress test.

OpenAI GPT-5 System Card · Models · 0.83

Cites as background 6 papers

AgentLeak shows violations frequently occur in internal inter-agent channels rather than user-facing outputs [ref] ; SumLeak formalizes compositional leakage in which individually innocuous responses aggregate into a sensitive attribute [ref] ; and prompt injection or environmental manipulation can elicit sensitive context at execution time [ref] .

2509.14284 · Related Work · 0.87
AgentLeak shows violations frequently occur in internal inter-agent channels rather than user-facing outputs [ref] ; SumLeak formalizes compositional leakage in which individually innocuous responses aggregate into a sensitive attribute [ref] ; and prompt injection or environmental manipulation can elicit sensitive context at execution time [ref] .

Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution · Related Work · 0.87
MEXTRA demonstrates black-box extraction of stored user–agent interactions [ref] ; Prompt Infection [ref] , MASLeak [ref] , and Agent-in-the-Middle [ref] show inter-agent channels can be exploited to self-replicate instructions, extract proprietary system information, or compromise an entire MAS.

IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems · Related Work · 0.86

Discussion

Disagree with the review, or know something it missed? Leave a comment, highlight any passage above to comment on it, or challenge this review formally.

[1] [2]

Openai gpt-5 system card.arXiv preprint arXiv:2601.03267. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. 2025a. Unveiling privacy risks in llm agent memory. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 25241–25260. Liwen Wang, Wenxuan Wang, S...

View on Pith Pith review arXiv 2026

[2] [2025]

The sum leaks more than its parts: Compo- sitional privacy risks and mitigations in multi-agent collaboration.arXiv preprint arXiv:2509.14284. Sandra Petronio. 1991. Communication boundary man- agement: A theoretical model of managing disclo- sure of private information between marital couples. Communication theory, 1(4):311–335. Sandra Petronio. 2002.Bou...

View on Pith arXiv 1991