Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning

• URL: http://arxiv.org/abs/2609.02967v1
• Date: Wed, 02 Sep 2026 07:57:12 GMT
• Title: Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning
• Abstract summary: FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.<n>Federation is not optional: off-the-shelf transfer collapses under distribution shift.<n>Live FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.
• Score: 67.04448659688579
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Topology-guided safeguards for LLM-based multi-agent systems (MAS) train a GNN over the inter-agent communication graph to localize risky agents and intervene on the topology---but they assume one operator can pool all labeled traces. Across organizations that assumption breaks: episodes contain private prompts, tool outputs, and proprietary workflows, and no silo alone sees the full attack distribution. We cast privacy-preserving MAS safeguarding as graph federated learning and instantiate FGLGuard: each operator fits an edge-featured graph attention detector on its own judge-labeled episode graphs and shares only model updates. The method couples a proximal local objective for non-IID clients, domain-balanced aggregation, over-refusal-constrained threshold calibration, corroborated upstream scoring, and a guarded rewrite for blocked answers. Federation is not optional: off-the-shelf transfer collapses under distribution shift (AUROC 0.51 to 0.70 only after in-domain retraining), so a deployable guard must adapt on each site's private traces. On Agent-SafetyBench, R-Judge, and AgentDojo, federated FGLGuard exceeds the in-domain centralized ceiling on all three benchmarks without pooling any data---where unsupervised anomaly guards and local-only training fail. One guard federated across four different-domain operators comes within 0.03 AUROC of multi-domain centralization, while any single-domain guard collapses on the others. Live FGLGuard cuts AgentDojo's ground-truth attack-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.

Related papers

• Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection [8.339789704552706]
  We present SkillGuard, a harness-level enforcement layer that treats contamination as contamination and restricts future capabilities to disconnect the resulting state from deployer-defined forbidden states.<n>We evaluate SkillGuard on four AgentDojo suites with two backend LLMs, Gemini 2.5 Flash and Llama3.3-70B, against an LLM-only No Defense baseline and three defenses at different system layers.
  arXiv  Detail & Related papers  (2026-08-30T20:57:47Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• FedGSA: Geometry-Consistent Subspace Aggregation for Differentially Private Federated LoRA [15.652808783124835]
  We propose a geometry-consistent aggregation framework for differentially private federated LoRA.<n>FedGSA represents each privatized client update as a basis-invariant subspace on the Grassmann manifold.<n>We prove that FedGSA incurs no additional privacy loss beyond client-side DP training and establish its convergence under standard assumptions.
  arXiv  Detail & Related papers  (2026-08-04T07:39:40Z)
• ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems [0.0]
  We present ChannelGuard, a framework placing information-bottleneck gates on every inter-agent channel.<n>ChannelGuard blocks Tool Poisoning 30 of 30 at the application layer, identically across Azure GPT-5, Anthropic Sonnet 4.5, and Anthropic Haiku 4.5.<n>It also lowers Prompt Injection attack success by half (0.333 to 0.167) and preserves GSM8K accuracy exactly (0.867)
  arXiv  Detail & Related papers  (2026-07-20T19:11:17Z)
• FedAttr: Towards Privacy-preserving Client-Level Attribution in Federated LLM Fine-tuning [58.80511162314259]
  We propose FedAttr, a new client-level attribution protocol for federated learning.<n>FedAttr identifies which clients trained on watermarked data via a paired-subset-difference mechanism.<n>It achieves 100% TPR and 0% FPR, outperforming all baselines by at least 44.4% in TPR or 19.1% in FPR, with only 6.3% overhead relative to FL training time.
  arXiv  Detail & Related papers  (2026-05-07T17:21:02Z)
• Beyond Single-Agent Alignment: Preventing Context-Fragmented Violations in Multi-Agent Systems [10.660248467840821]
  We identify and formalize a novel security risk: Context-Fragmented Violations (CFVs)<n>CFVs are a class of policy breaches where individual agent actions appear locally safe and reasonable, yet collectively violate organizational policies.<n>We propose Distributed Sentinel, a distributed zero-trust enforcement architecture.
  arXiv  Detail & Related papers  (2026-04-24T03:08:52Z)
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents [58.83028403414688]
  Large language model (LLM) agents execute tasks through multi-step workflow that combine planning, memory, and tool use.<n>Backdoor triggers injected into specific stages of an agent workflow can persist through multiple intermediate states and adversely influence downstream outputs.<n>We propose textbfBackdoorAgent, a modular and stage-aware framework that provides a unified agent-centric view of backdoor threats in LLM agents.
  arXiv  Detail & Related papers  (2026-01-08T03:49:39Z)
• PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents [60.23552141928126]
  PSG-Agent is a personalized and dynamic system for LLM-based agents.<n>First, PSG-Agent creates personalized guardrails by mining the interaction history for stable traits.<n>Second, PSG-Agent implements continuous monitoring across the agent pipeline with specialized guards.
  arXiv  Detail & Related papers  (2025-09-28T03:31:59Z)
• BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks [58.959622170433725]
  BlindGuard is an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors.<n>We show that BlindGuard effectively detects diverse attack types (i.e., prompt injection, memory poisoning, and tool attack) across multi-agent systems.
  arXiv  Detail & Related papers  (2025-08-11T16:04:47Z)
• CrowdGuard: Federated Backdoor Detection in Federated Learning [39.58317527488534]
  This paper presents a novel defense mechanism, CrowdGuard, that effectively mitigates backdoor attacks in Federated Learning. CrowdGuard employs a server-located stacked clustering scheme to enhance its resilience to rogue client feedback. The evaluation results demonstrate that CrowdGuard achieves a 100% True-Positive-Rate and True-Negative-Rate across various scenarios.
  arXiv  Detail & Related papers  (2022-10-14T11:27:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.