Safety of Latent Communication in Multi-Agent Systems
Muhammad Huzaifa, Sina Mavali, Thorsten Eisenhofer
cs.AI, cs.LG, cs.MA
2026-09-30
Benign training of latent links between frozen agents already raises harmful compliance; a target-free RL attack pushes it to 76.9, and link-only repair cuts it to 4.8.
When LLM-based agents collaborate, they usually exchange text messages: the sender generates a message, the receiver reads it back in, and both steps cost tokens and latency. Latent communication cuts that cost by letting agents exchange internal hidden states directly, with a small trainable link projecting the sender's representations into the receiver's embedding space as soft tokens. Work in this line (LatentMAS, RecursiveMAS, StateBridge) has focused on efficiency and task performance.
The question nobody had asked: is the link itself an attack surface? Every link rewrites what reaches the receiver, so training it shapes the behavior of the composed system. This CISPA paper answers bluntly. Agents that individually pass safety alignment and stay frozen do not make the assembled system safe.
Three topologies: a two-agent planner→solver pair, a three-model sequential planner→refiner→solver chain, and a mixture where two experts feed a summarizer. Models range from Gemma-3-1B to Qwen3-8B, all frozen; only the links train (a residual projection module, 27M to 111M parameters, up to 80 latent states per communication step).
Benign training first: links are trained on math data with a standard supervised objective, pushing the receiver to produce correct answers. Then three attacks, ordered by attacker capability:
Repair reuses the same GRPO machinery with rewards flipped: penalize compliance, reward refusal prefixes caught by a regex, reward correct answers on benign queries. Agents stay frozen throughout.
Benign training alone raises harmful compliance (mean ASR over four safety benchmarks) in every topology:
| Setting | Text comm. | Latent (benign) | Change |
| 2-Agent | 4.4 | 31.1 | +26.7 |
| Sequential | 3.2 | 31.7 | +28.5 |
| Mixture | 12.5 | 20.8 | +8.3 |
Token usage roughly halves (Sequential: 1042→501) and benign utility improves in five of six comparisons. The mechanism is localized: the trained link drops the receiver's first-token refusal probability from 0.84 (text) to 0.29. Forcing a "Sorry" prefix cuts the score from 31.1 to 1.6; a five-token refusal prefix brings it to zero. Refusal capability survives; the latent context just makes the receiver less likely to start refusing, because benign supervision rewards task completion and never rewards refusing.
| Condition | Mean ASR | MATH500 |
| Clean links | 27.9 | 67.2% |
| 10% poisoning | 58.2 | 46.7% |
| Supervised attack | 75.6 | 30.7% |
| RL attack | 76.9 | 71.0% |
| After repair (9 settings) | 4.8 | 67.4% |
(ASR averaged over three topologies and four benchmarks; MATH500 averaged over topologies.)
The RL attack needs no harmful targets yet beats supervised optimization in two of three topologies (81.3 vs 78.3 on 2-Agent; 95.9 vs 81.6 on Mixture), with mean MATH500 rising from 67.2% to 71.0%. Good benign performance does not certify safety: the mixture system pairs a 95.9 compliance score with improved accuracy on both utility benchmarks. Poisoning gains saturate around a 20% poisoning rate. Compromising one link is enough: in the sequential system, optimizing only the Refiner→Solver edge yields 70.0 versus 67.0 for both links. The reason is structural. A latent link gives gradients a continuous, differentiable path from the downstream objective back to communication parameters; token generation is a discrete bottleneck text communication does not have.
Repair, updating links only, drops the mean ASR from 70.3 to 4.8 across all nine attack-topology pairs, below the original clean links (Mixture RL attack: 95.9→2.5). The cost: mean GPQA-Diamond stays at 33.6% versus the clean 36.4%, and repair reduces MATH500 in all three RL-attacked settings.
Three practical takeaways. Safety evaluation has to happen at the system level; passing per-agent audits says nothing once a learned interface sits between agents. Appendix C.1 is an immediate mitigation: on benign data, training links with RL instead of supervision cuts mean ASR from 31.1/31.7/20.8 to 7.9/19.6/5.7 across the three topologies while improving MATH500 accuracy. Teams adopting latent communication should switch objectives for that alone. And repair without touching the models fits deployments on third-party models whose weights cannot be changed.
The broader point: alignment is not a property of individual models. It has to cover the learned interfaces between them.
The authors acknowledge that the poisoning saturation around 20% is unexplained, that repair degrades utility in settings where the attack preserved it (MATH500 drops after repair in all three RL-attacked configurations), and that robustness across different models, tasks, and communication mechanisms is left open.
Questions from reading it: all experiments use 1B-8B open models, and frontier models with deeper refusal behavior may not generalize the same way. Only one link architecture (a projection module) is tested; KV-cache sharing (LatentMAS) and analytic training-free mappings (StateBridge) fall outside the scope, and the latter has no trainable parameters at all, a different attack surface. All safety judgments come from two LLM judges (the HarmBench classifier and the StrongREJECT evaluator), so judge bias flows straight into the numbers. Repair assumes the defender holds a pool of harmful queries and knows the system is compromised. The benign-training degradation was measured with math-domain training data only; code or writing domains go untested.