Search papers, labs, and topics across Lattice.
This paper introduces Minimum-Necessary Communication (MNC), a semantic-declassification protocol designed to enhance privacy in multi-agent large language model (LLM) systems by specifying the conditions under which agents can disclose information. MNC establishes strict scopes for recipient, purpose, and memory usage, while a reference monitor enforces these scopes to prevent unauthorized data exposure. Experimental results demonstrate that MNC effectively maintains utility while significantly reducing the risk of inference attacks compared to traditional semantic declassification methods.
MNC can drastically limit unauthorized information leakage in multi-agent LLM systems while maintaining functional communication.
Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream. We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes. A reference monitor enforces these scopes across subsequent operations, while a history-aware extension accounts for inference risk accumulated over repeated disclosures. Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal. Under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. Two-backbone MAGPIE executions further show that mediated disclosures propagate through subsequent planning, tool use, coordination, and memory retrieval. These results support scope-bound semantic declassification as a practical communication boundary for private LLM-agent systems.
