LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems
Sadia Asif, Mohammad Mohammadi Amiri, Momin Abbas, Prasanna Sattigeri, Karthikeyan Natesan Ramamurthy
Abstract
Large language model (LLM)-based multi-agent systems increasingly rely on intermediate communication to coordinate complex tasks. While most existing systems communicate through natural language, recent work shows that latent communication, particularly through transformer key-value (KV) caches, can improve efficiency and preserve richer task-relevant information. However, KV caches also encode contextual inputs, intermediate reasoning states, and agent-specific information, creating an opaque channel through which sensitive content may propagate across agents without explicit textual disclosure. To address this, we introduce \textbf{LCGuard} (Latent Communication Guard), a framework for safe KV-based latent communication in multi-agent LLM systems. LCGuard treats shared KV caches as latent working memory and learns representation-level transformations before cache artifacts are transmitted across agents. We formalize representation-level sensitive information leakage operationally through reconstruction: a shared cache artifact is unsafe if an adversarial decoder can recover agent-specific sensitive inputs from it. This leads to an adversarial training formulation in which the adversary learns to reconstruct sensitive inputs, while LCGuard learns transformations that preserve task-relevant semantics and reduce reconstructable information. Empirical evaluations across multiple model families and multi-agent benchmarks show that LCGuard consistently reduces reconstruction-based leakage and attack success rates while maintaining competitive task performance compared to standard KV-sharing baselines.
AI Impact Assessments
(1 model)Scientific Impact Assessment: LCGuard
1. Core Contribution
LCGuard addresses a genuinely novel problem: privacy leakage through KV-cache sharing in multi-agent LLM systems. As latent communication via KV caches gains traction (LatentMAS, KVComm, C2C), the paper correctly identifies that these dense representations can encode and propagate sensitive agent-specific information — an attack surface that existing output-level safety mechanisms fundamentally cannot address.
The key technical contributions are: (1) formalizing reconstruction-based leakage as the operational definition of privacy risk in latent communication, (2) proposing a minimax adversarial training framework where lightweight residual bottleneck transformations are learned to sanitize KV caches before transmission, and (3) distinguishing between per-agent (local) and full-system (global) optimization variants that capture compositional leakage across multi-hop communication paths.
The reconstruction-based formalization is well-motivated: a shared KV artifact is "unsafe" if an adversarial decoder can recover sensitive inputs from it. This is more practically meaningful than information-theoretic measures for this setting, though it provides no formal privacy guarantees.
2. Methodological Rigor
Strengths in formulation: The minimax objective (Eq. 8) is clean and well-motivated, with the tradeoff parameter β providing interpretable control. The distinction between local and system-level leakage (Mobs = m_ij vs. Mobs = M) is principled and yields meaningful empirical differences.
Architecture: The residual bottleneck transformation (Eqs. 18-19) is sensible — the residual preserves task-relevant information while the bottleneck constrains fine-grained sensitive details. With ~16.8M parameters for d=4096, it's lightweight relative to the backbone models.
Experimental concerns: The evaluation is extensive across models (Qwen3-4B/8B/14B, Gemma-9B, LLaMA-3B/8B), benchmarks (PrivacyLens, AgentLeak, MAGPIE), and topologies (sequential, hierarchical, graph). However, several methodological concerns arise:
3. Potential Impact
Immediate impact: As KV-cache sharing becomes more prevalent in multi-agent systems (with concurrent work like KVFlow, TokenDance, C2C), LCGuard addresses a timely gap. Any deployment of latent multi-agent communication in sensitive domains (healthcare, finance, legal) would benefit from such safeguards.
Broader implications: The paper establishes "latent communication channels as attack surfaces" as a research direction, which could influence how the community designs future multi-agent communication protocols. The reconstruction-based threat model could become a standard evaluation framework for latent communication security.
Limitations on impact: Without formal privacy guarantees (acknowledged by the authors), adoption in high-stakes settings may be limited. The approach also assumes a specific threat model (decoder-based reconstruction) that may not capture all attack vectors.
4. Timeliness & Relevance
This paper is highly timely. KV-cache sharing in multi-agent systems is an active research front (ICLR 2026 papers on C2C and KVComm are cited as concurrent/recent work). The security implications of this paradigm shift from text-based to latent communication have been largely overlooked. The paper fills this gap precisely when it matters — before latent communication becomes widely deployed without privacy considerations.
5. Strengths & Limitations
Key Strengths:
Notable Weaknesses:
Additional Observations:
The paper's framing of KV caches as "latent working memory" is conceptually appealing and could influence how the community thinks about inter-agent communication design. The inference efficiency analysis (Table 10) showing only 0.04× overhead relative to vanilla KV sharing strengthens the practical case. However, the paper could have explored whether simpler approaches (e.g., selective KV token dropping based on sensitivity scores) might achieve comparable results with less training overhead.
Overall, this is a well-executed paper addressing a genuine and timely gap. The problem identification is the strongest contribution; the solution, while effective, is a relatively straightforward application of adversarial training to a new domain. The empirical evaluation is thorough but would benefit from stronger baselines and formal guarantees.
Generated May 22, 2026
Comparison History (18)
Paper 1 tackles a fundamental bottleneck in embodied AI and reinforcement learning by bridging visual foundation models with efficient planning and control. Its combination of theoretical guarantees for latent factor identification and strong empirical results on standard benchmarks gives it high methodological rigor. While Paper 2 addresses a timely privacy issue in LLMs, Paper 1 has broader potential applications across robotics, autonomous systems, and representation learning.
Paper 2 addresses a fundamental and pervasive challenge in LLMs—multi-step reasoning—using a highly novel application of hyperbolic geometry to model reasoning trees. Enhancing reasoning efficiency and accuracy has broad implications across almost all LLM applications. In contrast, Paper 1 tackles a crucial but more niche security and privacy issue specific to KV-sharing in multi-agent systems. The theoretical innovation and broader applicability of Paper 2 give it higher potential for widespread scientific impact.
LCGuard addresses a novel and increasingly critical problem—privacy/safety in latent KV-cache communication within multi-agent LLM systems. This is a nascent but rapidly growing area with broad implications for deploying multi-agent systems safely. The adversarial training framework for representation-level privacy is methodologically rigorous and addresses a gap no prior work has tackled. Paper 2, while technically sound, addresses a more incremental improvement to on-policy self-distillation in a narrow rare-token/identity setting. LCGuard's broader applicability to multi-agent safety and its formalization of latent information leakage give it higher potential impact across security, privacy, and multi-agent AI fields.
LCGuard addresses a novel and increasingly critical problem—privacy/safety in latent communication channels of multi-agent LLM systems—an area with growing practical importance as multi-agent deployments scale. It introduces a principled adversarial training framework with clear formalization, offering both methodological novelty and direct real-world applicability to secure AI systems. Paper 2, while valuable as a diagnostic benchmark revealing VLM limitations in spatial numerical understanding, is primarily an evaluation/analysis contribution with less actionable impact. LCGuard's work opens a new research direction at the intersection of security and multi-agent coordination, likely inspiring broader follow-up work.
Paper 1 addresses a critical and emerging security challenge in multi-agent LLM architectures—securing latent communication (KV cache sharing) against privacy leakage. Its focus on representation-level safety via adversarial training has profound implications for deploying secure, efficient multi-agent systems in real-world environments. In contrast, Paper 2 presents a benchmark for text-to-image prompting, which is valuable but narrower in scope and less likely to drive foundational shifts in AI safety and system design.
Paper 1 addresses error propagation in test-time scaling, a highly critical bottleneck in advancing reasoning capabilities of LLMs. Its approach to real-time error correction and trajectory diversification tackles immediate, high-impact challenges in building autonomous agents. Paper 2, while methodologically rigorous in addressing privacy in latent KV communication, focuses on a more niche and less universally adopted communication paradigm, giving Paper 1 broader applicability and a higher potential impact in the rapidly growing field of agentic reasoning.
Paper 2 likely has higher scientific impact: it advances core sequence modeling architecture by decoupling erase/write in linear attention, provides new algorithms (chunkwise WY, gate-aware backward) enabling efficient training, and demonstrates strong scaling and broad benchmark gains, especially for long-context retrieval—highly timely and broadly applicable across NLP and systems. Paper 1 addresses an important safety issue in multi-agent KV-sharing, but its impact is narrower (specific to latent KV communication setups) and depends on adoption of KV-sharing agents; it also hinges on a particular leakage definition (reconstruction) that may not cover all threat models.
Paper 2 has higher estimated impact due to stronger timeliness and broad applicability: securing latent KV-cache communication is a rapidly emerging need as multi-agent LLM systems adopt KV sharing for efficiency. LCGuard introduces a clear threat model (reconstruction-based leakage) and an adversarial training approach that can generalize across model families and agent settings, with direct real-world implications for privacy and safety. Paper 1 is novel and useful for prompt optimization under aggregate feedback, but its scope is narrower and closer to existing Bayesian optimization/prompt-tuning lines.
Paper 1 addresses a fundamental and highly relevant challenge in AI: improving the token efficiency and reasoning capabilities of LLM agents. By introducing a self-regulated simulative planning framework, it achieves massive performance gains with much smaller models and significantly fewer tokens. This has broad implications for scaling inference-time compute. Paper 2, while methodologically sound and addressing an important security concern, focuses on a narrower niche (KV cache privacy in multi-agent systems), limiting its overall breadth of impact compared to Paper 1's contributions to general LLM reasoning.
Paper 2 (Skill Weaving) likely has higher impact due to broad applicability: modular “skillpacks” and compression for specialization under fixed memory/inference budgets directly address major deployment constraints across many domains and model sizes. If results hold (9B surpassing 32B with speedups), the real-world implications for edge, enterprise, and agentic systems are substantial. The idea is timely amid demand for efficient post-training adaptation. Paper 1 is novel and important for safety in latent KV sharing, but its scope is narrower (multi-agent KV-cache communication) and depends on adoption of that specific communication paradigm.