From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability

• URL: http://arxiv.org/abs/2606.07150v1
• Date: Fri, 05 Jun 2026 11:07:55 GMT
• Title: From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability
• Abstract summary: A2A and MCP protocols standardize what agents say to one another, but assume address-based transport over HTTP(S)<n>What they leave in the clear is the communication graph: which agent contacts which, when, and how often.<n>We give a threat model for the agent communication graph; identify what makes agent metadata distinctively revealing.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Agent-interoperability protocols such as A2A and MCP standardize what agents say to one another, but assume address-based transport over HTTP(S). Such transports protect message content, increasingly with end-to-end encryption. What they leave in the clear is the communication graph: which agent contacts which, when, and how often. In agent systems this graph is more consequential than a privacy framing suggests. Endpoints are often capability-labeled, workflows are structured and chained, and interactions are coupled to real actions, so an observer recovers more than past relationships. It can infer the pending workflow, the task being assembled and the action likely to follow. At machine speed, it can act on that inference before the workflow completes. The threat is therefore one of workflow integrity, not privacy alone: predictive leverage over autonomous action. We give a threat model for the agent communication graph; identify what makes agent metadata distinctively revealing (semanticity, prospectivity, actuation); define transport- and bootstrap-layer privacy properties and weigh candidate transports (SimpleX/SMP, Tor, mixnets) against them; and present an A2A case study in which a metadata-protecting binding is expressible but surfaces the protocol's identity assumptions. We test these on a generative model anchored to a real A2A capture. From passive metadata alone, with no payloads, a classifier recovers a task's class well above chance, from only the workflow's opening; applied together, the properties drive that recovery sharply back toward chance. Beyond what an observer can recover, we measure the leverage of acting on the leak: from a workflow's opening and under a fixed budget, an adversary choosing which workflows to act on realizes in this model most of a clairvoyant attacker's advantage over a metadata-blind one, and the same properties suppress it.

Related papers

• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extraction [26.52125777621677]
  We evaluate the trade-off of task accuracy and privacy leakage.<n>We propose structural private field isolation, which replaces private fields with hash keys before they reach the model.
  arXiv  Detail & Related papers  (2026-06-17T12:17:02Z)
• From Question Answering to Task Completion: A Survey on Agent System and Harness Design [67.8241530947325]
  This survey examines LLM-based agents through a model-harness lens.<n>We first clarify the functional definition of agents and the implementation view of an LLM-based agent as a foundation model and an execution harness.<n>We then analyze the limits of model-centric scaling, trace four paradigms of agent engineering, and decompose the execution harness into six coupled runtime responsibilities.
  arXiv  Detail & Related papers  (2026-06-14T05:40:16Z)
• HLL: Can Agents Cross Humanity's Last Line of Verification? [27.923163104768758]
  We introduce textbfHumanity's Last Line of Verification (HLL) to evaluate whether agents can cross this boundary through grounded, human-like interaction.<n>HLL covers diverse CAPTCHA interactions and exposes agents to controlled realism stressors.<n>Results show that current agents remain brittle at this human-substitution boundary.
  arXiv  Detail & Related papers  (2026-06-01T16:20:45Z)
• Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces [5.370915507935483]
  We show that an agent's actions and interaction timings, captured via a passive JavaScript tracker, are sufficient to identify the underlying model with up to 96% F1.<n>We release our harness and a labelled corpus of agent traces.
  arXiv  Detail & Related papers  (2026-05-14T12:55:19Z)
• Agentic Peer-to-Peer Networks: From Content Distribution to Capability and Action Sharing [10.47562113256175]
  This article outlines the networking foundations needed to make such collaboration practical.<n>We propose a plane-based reference architecture that decouples connectivity/identity, semantic discovery, and execution.<n>We also present a textittiered verification spectrum: Tier1 relies on reputation signals, Tier2 applies lightweight canary challenge-response with fallback selection, and Tier3 requires evidence packages such as signed tool receipts/traces.
  arXiv  Detail & Related papers  (2026-03-04T05:58:44Z)
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents [58.83028403414688]
  Large language model (LLM) agents execute tasks through multi-step workflow that combine planning, memory, and tool use.<n>Backdoor triggers injected into specific stages of an agent workflow can persist through multiple intermediate states and adversely influence downstream outputs.<n>We propose textbfBackdoorAgent, a modular and stage-aware framework that provides a unified agent-centric view of backdoor threats in LLM agents.
  arXiv  Detail & Related papers  (2026-01-08T03:49:39Z)
• Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs [26.288357188171265]
  MAMA (Multi-Agent Memory Attack) is a framework that measures how network structure shapes leakage.<n>We quantify leakage as the fraction of ground-truth PII recovered from attacking agent outputs.<n>Results provide the first systematic mapping from architectural choices to measurable privacy risk.
  arXiv  Detail & Related papers  (2025-12-04T11:00:49Z)
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain [82.98626829232899]
  Fine-tuning AI agents on data from their own interactions introduces a critical security vulnerability within the AI supply chain.<n>We show that adversaries can easily poison the data collection pipeline to embed hard-to-detect backdoors.
  arXiv  Detail & Related papers  (2025-10-03T12:47:21Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• Traffic Agent Trajectory Prediction Using Social Convolution and Attention Mechanism [57.68557165836806]
  We propose a model to predict the trajectories of target agents around an autonomous vehicle. We encode the target agent history trajectories as an attention mask and construct a social map to encode the interactive relationship between the target agent and its surrounding agents. To verify the effectiveness of our method, we widely compare with several methods on a public dataset, achieving a 20% error decrease.
  arXiv  Detail & Related papers  (2020-07-06T03:48:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.