Elamur Research⌕
☰
home / papers / 2026 / Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs

Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs

Paper · 2026 · Jinbo Liu, Defu Cao, Yifei Wei et al.

Summary

LLM agents increasingly work in teams that exchange messages over a communication graph. This paper asks how the shape of that graph affects how easily private data stored in one agent's memory can be extracted by a malicious teammate. The authors build MAMA (Multi-Agent Memory Attack), a controlled benchmark.

  • Data: synthetic documents with labeled PII entities are given only to a target agent. All agents receive a sanitized version of the task that contains no PII, so any leak must come from the target's memory.
  • Protocol: an Engram phase seeds the target's memory. A Resonance phase of up to 10 rounds follows, in which an attacker agent probes for the data.
  • Scoring: recovery is measured by exact matching plus an LLM-based inference step over the attacker's final output.
  • Experimental grid: six topologies, team sizes of 4–6, varied attacker–target placements and several base models.

Leakage grows with denser connections, shorter attacker–target distance and higher target centrality. Most leakage happens early and then levels off. These findings give system designers concrete, topology-level levers for limiting privacy risk.

Key points

  • The six topologies are complete, circle, chain, binary tree, star and star-ring. Complete graphs (along with star-ring) are among the most leak-prone, while chain and tree structures protect best.
  • Leakage follows a rapid-rise-then-plateau curve over the 10 rounds. Larger teams leak slightly less in the end but spread information faster in early rounds.
  • Base models tested include Llama-3.1-70B, DeepSeek-V3.1, GPT-4o and GPT-4o-mini. At n=4, Llama-3.1-70B leaks 29.65% on complete graphs versus 16.51% for DeepSeek-V3.1. The GPT models leak far less, but the broad topology trends stay similar.
  • PII types leak in this order: spatiotemporal > location ≥ contact/network ≥ org-IDs ≫ names > regulated IDs. Regulated IDs such as SSNs and card numbers stay near zero.
  • The authors recommend sparse or hierarchical graphs, keeping the attacker far from the target, and restricting hubs and shortcuts. Code is at github.com/llll121/mama-eval.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of Southern CaliforniaLos Angeles · United States162 works · 35,836 citations🎓Arizona State UniversityTempe · United States50 works · 2,032 citations🎓Florida State UniversityTallahassee · United States8 works · 363 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksSocial Sciences · 1,772 worksSociology and Political Science · 577 works

Cite

Cite as Jinbo Liu, Defu Cao, Yifei Wei, Tianyao Su, Yuan Liang, Yushun Dong, Yan Liu, Yue Zhao and Xiyang Hu. 2026. Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1980

@inproceedings{liu2026topology,
  title = {{Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs}},
  author = {Jinbo Liu, Defu Cao, Yifei Wei, Tianyao Su, Yuan Liang, Yushun Dong, Yan Liu, Yue Zhao and Xiyang Hu},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1980},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1980}
}

References

18 references, 2 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Gretel AI. 2024. Gliner models for pii detection through fine-tuning on gretel-generated synthetic documents. find
  2. Timothy J Boerner, Stephen Deems, Thomas R Furlani, Shelley L Knuth, and John Towns. 2023. Access: Advancing innovation: Nsf’s advanced cyberinfrastructure coordination ecosystem: Services & support. In Practice and Experience in Advanced Research Computing 2023: Computing for the Common Good, pages… find
  3. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:130185–130213. find
  4. Jianshuo Dong, Sheng Guo, Hao Wang, Xun Chen, Zhuotao Liu, Tianwei Zhang, Ke Xu, Minlie Huang, and Han Qiu. 2025a. Safesearch: Automated red-teaming for the safety of llm-based search agents. arXiv preprint arXiv:2509.23694. — [arXiv:2509.23694](https://arxiv.org/abs/2509.23694) find
  5. Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. 2025b. Memory injection attacks on llm agents via query-only interaction. arXiv preprint arXiv:2503.03704. — [arXiv:2503.03704](https://arxiv.org/abs/2503.03704) find
  6. Jen-tse Huang, Jiaxu Zhou, Tailin Jin, Xuhui Zhou, Zixi Chen, Wenxuan Wang, Youliang Yuan, Michael R Lyu, and Maarten Sap. 2024. On the resilience of llm-based multi-agent collaboration with faulty agents. arXiv preprint arXiv:2408.00989. — [arXiv:2408.00989](https://arxiv.org/abs/2408.00989) find
  7. Shilong Wang, Guibin Zhang, Miao Yu, Guancheng Wan, Fanci Meng, Chongye Guo, Kun Wang, and Yang Wang. 2025c. G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume…
  8. Duncan J Watts and Steven H Strogatz. 1998. Collective dynamics of ‘small-world’networks. nature, 393(6684):440–442. find
  9. Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Qingsong Wen, Kun Wang, and Yang Wang. 2024. Netsafe: Exploring the topological safety of multi-agent networks. arXiv preprint arXiv:2410.15686. — [arXiv:2410.15686](https://arxiv.org/abs/2410.15686) find
  10. Can Zheng, Yuhan Cao, Xiaoning Dong, and Tianxing He. 2025. Demonstrations of integrity attacks in multi-agent systems. arXiv preprint arXiv:2506.04572. — [arXiv:2506.04572](https://arxiv.org/abs/2506.04572) find
  11. A We explicitly define the edge sets E for n agents indexed 0, . . . , n − 1 for each topology used in our experiments: • Chain: A linear path minimizing connectivity. E chain = {(i, i + 1), (i + 1, i) \| 0 ≤ i ≤ n − 2}. • Circle: A closed chain offering two equidistant paths between antipodal nodes. find
  12. J.F. Kurose and K.W. Ross. 2017. Computer Networking: A Top-down Approach. Pearson. find
  13. Xinyi Li, Sai Wang, Siqi Zeng, Yu Wu, and Yi Yang. 2024. A survey on llm-based multi-agent systems: workflow, infrastructure, and challenges. Vicinagearth, 1(1):9. find
  14. Mark EJ Newman and Duncan J Watts. 1999. Renormalization group analysis of the small-world network model. Physics Letters A, 263(4-6):341–346. find
  15. Harold Triedman, Rishi Jha, and Vitaly Shmatikov. 2025. Multi-agent systems execute arbitrary malicious code. arXiv preprint arXiv:2503.12188. — [arXiv:2503.12188](https://arxiv.org/abs/2503.12188) find
  16. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. 2025a. Unveiling privacy risks in llm agent memory. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 25241–25260.
  17. Liwen Wang, Wenxuan Wang, Shuai Wang, Zongjie Li, Zhenlan Ji, Zongyi Lyu, Daoyuan Wu, and Shing-Chi Cheung. 2025b. Ip leakage attacks targeting llm-based multi-agent systems. arXiv preprint arXiv:2505.12442. — [arXiv:2505.12442](https://arxiv.org/abs/2505.12442) find
  18. Topology Edge Definitions E circle = E chain ∪ {(0, n − 1), (n − 1, 0)}. • Star-Pure: A centralized hub (node 0) mediating all leaf-to-leaf traffic. E star = {(0, i), (i, 0) \| 1 ≤ i ≤ n − 1}. • Star-Ring: A hybridized structure adding a peripheral ring to the star, introducing shortcuts between leav… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/liu-2026-topology-matters-measuring-memory-leakage/