MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication

• URL: http://arxiv.org/abs/2608.01719v1
• Date: Mon, 03 Aug 2026 05:36:49 GMT
• Title: MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
• Abstract summary: Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory.<n>We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that binds a task-sufficient disclosure to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes.<n>Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal.
• Score: 6.029029648872896
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream. We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes. A reference monitor enforces these scopes across subsequent operations, while a history-aware extension accounts for inference risk accumulated over repeated disclosures. Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal. Under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. Two-backbone MAGPIE executions further show that mediated disclosures propagate through subsequent planning, tool use, coordination, and memory retrieval. These results support scope-bound semantic declassification as a practical communication boundary for private LLM-agent systems.

Related papers

• Memory-Augmented LLM-based Multi-Agent System for Automated Feature Generation on Tabular Data [52.80567461420316]
  We propose a Memory-Augmented LLM-based Multi-Agent System (textbfMALMAS) for automated feature generation.<n>MALMAS decomposes the generation process into agents with distinct responsibilities, and a Router Agent activates an appropriate subset of agents per iteration.<n>We further integrate a memory module comprising procedural memory, feedback memory, and conceptual memory, enabling iterative refinement that adaptively guides subsequent feature generation.
  arXiv  Detail & Related papers  (2026-04-22T07:09:30Z)
• CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution [1.9473631530390483]
  CapSeal is a capability-sealed secret mediation architecture that replaces direct secret access with constrained invocations through a local trusted broker.<n>We describe a Rust prototype integrated with an MCP-facing adapter, formulate conditional security goals for non-disclosure, constrained use, replay resistance, and auditability.
  arXiv  Detail & Related papers  (2026-04-18T00:23:32Z)
• CBCL: Safe Self-Extending Agent Communication [0.0]
  We present CBCL (Common Business Communication Language), an agent communication language that constrains all messages, including runtime language extensions, to the deterministic context-free language (DCFL) class.<n> CBCL allows agents to define, transmit, and adopt domain-specific "dialect" extensions as first-class messages; three safety invariants (R1-R3), machine-checked Lean 4 and enforced in a Rust reference implementation.
  arXiv  Detail & Related papers  (2026-04-16T00:57:48Z)
• Sovereign Context Protocol: An Open Attribution Layer for Human-Generated Content in the Age of Large Language Models [0.0]
  Sovereign Context Protocol functions as an attribution-aware data access layer between Large Language Models and human-generated content.<n> SCP defines six core methods (creator profiles, semantic search, content retrieval, trust/value scoring, authenticity verification, and access auditing) exposed over both REST and MCP-compatible interfaces.
  arXiv  Detail & Related papers  (2026-03-28T02:28:41Z)
• NeuroFilter: Privacy Guardrails for Conversational LLM Agents [50.75206727081996]
  This work addresses the computational challenge of enforcing privacy for agentic Large Language Models (LLMs)<n>NeuroFilter is a guardrail framework that operationalizes contextual integrity by mapping norm violations to simple directions in the model's activation space.<n>A comprehensive evaluation across over 150,000 interactions, covering models from 7B to 70B parameters, illustrates the strong performance of NeuroFilter.
  arXiv  Detail & Related papers  (2026-01-21T05:16:50Z)
• LLMs Can't Play Hangman: On the Necessity of a Private Working Memory for Language Agents [18.273509519961255]
  We define Private State Interactive Tasks (PSITs)<n>PSITs require agents to generate and maintain hidden information while producing consistent public responses.<n>We show theoretically that any agent restricted to the public conversation history cannot simultaneously preserve secrecy and consistency in PSITs.<n>We propose a novel architecture incorporating an explicit private working memory.
  arXiv  Detail & Related papers  (2026-01-11T16:06:58Z)
• CoTGuard: Using Chain-of-Thought Triggering for Copyright Protection in Multi-Agent LLM Systems [55.57181090183713]
  We introduce CoTGuard, a novel framework for copyright protection that leverages trigger-based detection within Chain-of-Thought reasoning.<n>Specifically, we can activate specific CoT segments and monitor intermediate reasoning steps for unauthorized content reproduction by embedding specific trigger queries into agent prompts.<n>This approach enables fine-grained, interpretable detection of copyright violations in collaborative agent scenarios.
  arXiv  Detail & Related papers  (2025-05-26T01:42:37Z)
• Generative AI-aided Joint Training-free Secure Semantic Communications via Multi-modal Prompts [89.04751776308656]
  This paper proposes a GAI-aided SemCom system with multi-model prompts for accurate content decoding. In response to security concerns, we introduce the application of covert communications aided by a friendly jammer.
  arXiv  Detail & Related papers  (2023-09-05T23:24:56Z)
• SemProtector: A Unified Framework for Semantic Protection in Deep Learning-based Semantic Communication Systems [51.97204522852634]
  We present a unified framework that aims to secure an online semantic communications system with three semantic protection modules. Specifically, these protection modules are able to encrypt semantics to be transmitted by an encryption method, mitigate privacy risks from wireless channels by a perturbation mechanism, and calibrate distorted semantics at the destination. Our framework enables an existing online SC system to dynamically assemble the above three pluggable modules to meet customized semantic protection requirements.
  arXiv  Detail & Related papers  (2023-09-04T06:34:43Z)
• Adversarial Learning for Implicit Semantic-Aware Communications [104.08383219177557]
  We develop a novel adversarial learning-based implicit semantic-aware communication architecture (iSAC) We prove that by applying iSAC, the destination user can always learn an inference rule that matches the true inference rule of the source messages. Experimental results show that the proposed iSAC can offer up to a 19.69 dB improvement over existing non-inferential communication solutions.
  arXiv  Detail & Related papers  (2023-01-27T08:28:12Z)
• Metadata Privacy Beyond Tunneling for Instant Messaging [0.0]
  We show that deniable traffic achieves metadata privacy against strong adversaries. We show that existing state-of-the-art protocols can be extended to support metadata privacy. We implement and evaluate a proof-of-concept instant messaging system running DenIM on top of unmodified Signal.
  arXiv  Detail & Related papers  (2022-10-23T16:32:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.