Elamur Research⌕
☰
home / papers / 2026 / CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems

CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems

Paper · 2026 · Yongxuan Wu, Xixun Lin, He Zhang et al.

Summary

The paper asks whether an outsider can reconstruct the hidden communication graph of an LLM-based multi-agent system (MAS), meaning which agents pass messages to which. The authors argue this graph is both a security weakness and valuable intellectual property. An attacker who knows it can target key agents, and a carefully optimized topology is a costly proprietary asset. They propose CIA (Communication Inference Attack), which needs only black-box access: it sends queries and reads final answers.

CIA works in two stages:

  • Reasoning output induction: specially crafted prompts push the system to carry each intermediate agent's reasoning through to the final response.
  • Semantic correlations modeling: CIA links agents whose recovered outputs are semantically dependent. Two components support this step. Global bias disentanglement removes similarity caused by agents sharing the same task and LLM. LLM-guided weak supervision supplies a few confident edges from a teacher model.

The attack was tested on systems built with G-Designer, AGP and ARG-Designer across MMLU, GSM8K, SVAMP and HumanEval. It reached an average AUC of 0.87 and a best AUC of about 0.99, which shows that topology leakage is a real privacy risk.

Key points

  • Output recovery: the adversarial queries recover intermediate agent outputs with Recall and ROUGE-L of roughly 0.87–0.96. Recovery is strongest on the simpler ARG-Designer topologies.
  • Stealth: task accuracy with adversarial queries is nearly the same as with standard ones, so the attack does not disrupt the system and looks like ordinary use.
  • Global bias disentanglement (GBD): it cuts the false positive rate by at least 50%. Without it, AUC drops to about 0.51–0.63, compared with 0.75–0.99 for full CIA.
  • LLM-guided weak supervision (LWS): the teacher LLM's top-k edges are reliable mainly for k ≤ 3. LWS raises AUC in every setting, for example from 0.90 to 0.99 on GSM8K with ARG-Designer.
  • Code and limitations: code is released at github.com/aabbbcd/CIA. The authors note two limitations: estimating multivariate mutual information is hard, and the weak supervision captures only first-order topology.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

Cite

Cite as Yongxuan Wu, Xixun Lin, He Zhang, Nan Sun, Kun Wang, Chuan Zhou, Shirui Pan and Yanan Cao. 2026. CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.815

@inproceedings{wu2026cia,
  title = {{CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems}},
  author = {Yongxuan Wu, Xixun Lin, He Zhang, Nan Sun, Kun Wang, Chuan Zhou, Shirui Pan and Yanan Cao},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.815},
  url = {https://doi.org/10.18653/v1/2026.acl-long.815}
}

References

48 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Alfonso Amayuelas, Xianjun Yang, Antonis Antoniades, Wenyue Hua, Liangming Pan, and William Yang Wang. 2024. Multiagent collaboration attack: Investigating adversarial attacks in large language model collaborations via debate. In Findings of the Association for Computational Linguistics: EMNLP 2024,… find
  2. Ke Bai, Pengyu Cheng, Weituo Hao, Ricardo Henao, and Larry Carin. 2023. Estimating total correlation with mutual information estimators. In International Conference on Artificial Intelligence and Statistics, 25-27 April 2023, Palau de Congressos, Valencia, Spain, Proceedings of Machine Learning Rese… find
  3. Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeswar, Sherjil Ozair, Yoshua Bengio, R. Devon Hjelm, and Aaron C. Courville. 2018. Mutual information neural estimation. In Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsmässan, Stockholm, Sweden, July 10… find
  4. Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ B. Altman, Simran Arora, Sydney von Arx, Michael S. Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, Erik Brynjolfsson, Shyamal Buch, Dallas Card, Rodrigo Castellon, Niladri S. Chatterji, Annie S. Chen, Kathleen Creel, Jared Quincy Davis… — On the Opportunities and Risks of Foundation Models
  5. Konstantinos Bousmalis, George Trigeorgis, Nathan Silberman, Dilip Krishnan, and Dumitru Erhan. 2016. Domain separation networks. In Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, December 5-10, 2016, Barcelona, Spain, pages 343… find
  6. Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya G. Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. 2025. Why do multi-agent LLM systems fail? CoRR, abs/2503.13657.
  7. Pradipta Kishore Chakrabarty. 2025. Causal inference in agentic ai: Bridging explainability and dynamic decision making. International Journal of Science and Research (IJSR). find
  8. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Pondé de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, and 39 others. 202… — Evaluating Large Language Models Trained on Code
  9. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. 2021. Training verifiers to solve math word problems. CoRR, abs/2110.14168.
  10. Tim Dettmers, Pasquale Minervini, Pontus Stenetorp, and Sebastian Riedel. 2018. Convolutional 2d knowledge graph embeddings. In Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, (AAAI-18), the 30th innovative Applications of Artificial Intelligence (IAAI-18), and the 8th A… find
  11. Alireza Ghafarollahi and Markus J Buehler. 2025. Sciagents: automating scientific discovery through bioinspired multi-agent intelligent graph reasoning. Advanced Materials, 37(22):2413523. find
  12. Nathan Godey, Éric Villemonte de la Clergerie, and Benoît Sagot. 2024. Anisotropy is inherent to self-attention in transformers. In Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics, EACL 2024 - Volume 1: Long Papers, St. Julian’s, Malta, Mar… find
  13. James A Hanley and Barbara J McNeil. 1982. The meaning and use of the area under a receiver operating characteristic (roc) curve. Radiology, 143(1):29– 36. find
  14. Junda He, Christoph Treude, and David Lo. 2025a. Llm-based multi-agent systems for software engineering: Literature review, vision, and the road ahead. ACM Trans. Softw. Eng. Methodol., 34(5):124:1–124:30. find
  15. Pengfei He, Yuping Lin, Shen Dong, Han Xu, Yue Xing, and Hui Liu. 2025b. Red-teaming LLM multi-agent systems via communication attacks. In Findings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27 - August 1, 2025, Findings of ACL, pages 6726–6747. Association for… find
  16. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net.
  17. Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. 2024. Metagpt: Meta programming for A multi-agent collaborative framework. In The T…
  18. Jen-tse Huang, Jiaxu Zhou, Tailin Jin, Xuhui Zhou, Zixi Chen, Wenxuan Wang, Youliang Yuan, Maarten Sap, and Michael R. Lyu. 2024. On the resilience of multi-agent systems with malicious agents. CoRR, abs/2408.00989. — [arXiv:2408.00989](https://arxiv.org/abs/2408.00989) find
  19. Ye Jin, Xiaoxi Shen, Huiling Peng, Xiaoan Liu, Jingli Qin, Jiayang Li, Jintao Xie, Peizhong Gao, Guyue Zhou, and Jiangtao Gong. 2023. Surrealdriver: Designing generative driver agent simulation framework in urban contexts based on large language model. CoRR, abs/2309.13193. — [arXiv:2309.13193](https://arxiv.org/abs/2309.13193) find
  20. Dezhang Kong, Shi Lin, Zhenhua Xu, Zhebo Wang, Minghao Li, Yufeng Li, Yilun Zhang, Hujin Peng, Zeyang Sha, Yuyuan Li, Changting Lin, Xun Wang, Xuan Liu, Ningyu Zhang, Chaochao Chen, Muhammad Khurram Khan, and Meng Han. 2025. A survey of llm-driven AI agent communication: Protocols, security risks, a… — [arXiv:2506.19676](https://arxiv.org/abs/2506.19676) find
  21. Donghyun Lee and Mo Tiwari. 2024. Prompt infection: Llm-to-llm prompt injection within multi-agent systems. CoRR, abs/2410.07283. — [arXiv:2410.07283](https://arxiv.org/abs/2410.07283) find
  22. Ang Li, Yin Zhou, Vethavikashini Chithrra Raghuram, Tom Goldstein, and Micah Goldblum. 2025a. Commercial LLM agents are already vulnerable to simple yet dangerous attacks. CoRR, abs/2502.08586. — [arXiv:2502.08586](https://arxiv.org/abs/2502.08586) find
  23. Boyi Li, Zhonghan Zhao, Der-Horng Lee, and Gaoang Wang. 2025b. Adaptive graph pruning for multi-agent communication. In ECAI 2025 - 28th European Conference on Artificial Intelligence, 25-30 October 2025, Bologna, Italy - Including 14th Conference on Prestigious Applications of Intelligent Systems (… find
  24. Guohao Li, Hasan Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. 2023. CAMEL: communicative agents for "mind" exploration of large language model society. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 20…
  25. Junyou Li, Qin Zhang, Yangbin Yu, Qiang Fu, and Deheng Ye. 2024. More agents is all you need.
  26. Trans. Mach. Learn. Res., 2024. find
  27. Shiyuan Li, Yixin Liu, Qingsong Wen, Chengqi Zhang, and Shirui Pan. 2026. Assemble your crew: Automatic multi-agent communication topology design via autoregressive graph generation. In Fortieth AAAI Conference on Artificial Intelligence, Thirty-Eighth Conference on Innovative Applications of Artifi… find
  28. Xixun Lin, Yucheng Ning, Jingwen Zhang, Yan Dong, Yilong Liu, Yongxuan Wu, Xiaohua Qi, Nan Sun, Yanmin Shang, Pengfei Cao, Lixin Zou, Xu Chen, Chuan Zhou, Jia Wu, Shirui Pan, Bin Wang, Yanan Cao, Kai Chen, Songlin Hu, and Li Guo. 2025. Llm-based agents suffer from hallucinations: A survey of taxonom… — [arXiv:2509.18970](https://arxiv.org/abs/2509.18970) find
  29. Yixin Liu, Guibin Zhang, Kun Wang, Shiyuan Li, and Shirui Pan. 2025. Graph-augmented large language model agents: Current progress and future prospects. CoRR, abs/2507.21407. — [arXiv:2507.21407](https://arxiv.org/abs/2507.21407) find
  30. Arkil Patel, Satwik Bhattamishra, and Navin Goyal. 2021. Are NLP models really able to solve simple math word problems? In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2021, Online, June 6-11…
  31. Chen Qian, Wei Liu, Hongzhang Liu, Nuo Chen, Yufan Dang, Jiahao Li, Cheng Yang, Weize Chen, Yusheng Su, Xin Cong, Juyuan Xu, Dahai Li, Zhiyuan Liu, and Maosong Sun. 2024. Chatdev: Communicative agents for software development. In Proceedings of the 62nd Annual Meeting of the Association for Computat…
  32. Shaina Raza, Ranjan Sapkota, Manoj Karkee, and Christos Emmanouilidis. 2026. Trism for agentic AI: A review of trust, risk, and security management in llm-based agentic multi-agent systems. AI Open, 7:71–95. find
  33. Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. Reflexion: language agents with verbal reinforcement learning. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans,…
  34. Patrick Taillandier, Jean-Daniel Zucker, Arnaud Grignard, Benoît Gaudou, Nghi Quang Huynh, and Alexis Drogoul. 2025. Integrating LLM in agent-based social simulation: Opportunities and challenges. CoRR, abs/2507.19364. — [arXiv:2507.19364](https://arxiv.org/abs/2507.19364) find
  35. Aäron van den Oord, Yazhe Li, and Oriol Vinyals. 2018. Representation learning with contrastive predictive coding. CoRR, abs/1807.03748.
  36. Qian Wang, Tianyu Wang, Zhenheng Tang, Qinbin Li, Nuo Chen, Jingsheng Liang, and Bingsheng He. 2025. Megaagent: A large-scale autonomous llm-based multi-agent system without predefined sops. In Findings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27 - August 1,… find
  37. Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024a. Badagent: Inserting and activating backdoor attacks in LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024,… find
  38. Zhenhailong Wang, Shaoguang Mao, Wenshan Wu, Tao Ge, Furu Wei, and Heng Ji. 2024b. Unleashing the emergent cognitive synergy in large language models: A task-solving agent through multi-persona self-collaboration. In Proceedings of the 2024 Conference of the North American Chapter of the Association…
  39. Michael Satosi Watanabe. 1960. Information theoretical analysis of multivariate correlation. IBM J. Res. Dev., 4(1):66–82. find
  40. Bingyu Yan, Xiaoming Zhang, Ziyi Zhou, Chaozhuo Li, Ruilin Zeng, Yirui Qi, Tianbo Wang, and Litian Zhang. 2026. Attack the messages, not the agents: A multi-round adaptive stealthy tampering framework for LLM-MAS. In Fortieth AAAI Conference on Artificial Intelligence, Thirty-Eighth Conference on In… find
  41. John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. 2024. Swe-agent: Agent-computer interfaces enable automated software engineering. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing…
  42. Miao Yu, Fanci Meng, Xinyun Zhou, Shilong Wang, Junyuan Mao, Linsey Pang, Tianlong Chen, Kun Wang, Xinfeng Li, Yongfeng Zhang, Bo An, and Qingsong Wen. 2025a. A survey on trustworthy LLM agents: Threats and countermeasures. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and… find
  43. Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Kun Wang, Qingsong Wen, and Yang Wang. 2025b. Netsafe: Exploring the topological safety of multi-agent system. In Findings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27 - August 1, 202… find
  44. Weichen Yu, Kai Hu, Tianyu Pang, Chao Du, Min Lin, and Matt Fredrikson. 2025c. Infecting LLM agents via generalizable adversarial attack. In Red Teaming GenAI: What Can We Learn from Adversaries? find
  45. Guibin Zhang, Yanwei Yue, Xiangguo Sun, Guancheng Wan, Miao Yu, Junfeng Fang, Kun Wang, Tianlong Chen, and Dawei Cheng. 2025a. G-designer: Architecting multi-agent communication topologies via graph neural networks. In Forty-second International Conference on Machine Learning, ICML 2025, Vancouver,… find
  46. Jiayi Zhang, Jinyu Xiang, Zhaoyang Yu, Fengwei Teng, Xionghui Chen, Jiaqi Chen, Mingchen Zhuge, Xin Cheng, Sirui Hong, Jinlin Wang, Bingnan Zheng, Bang Liu, Yuyu Luo, and Chenglin Wu. 2025b. Aflow: Automating agentic workflow generation. In The Thirteenth International Conference on Learning Represe…
  47. Yangze Zhou, Gitta Kutyniok, and Bruno Ribeiro. 2022. OOD link prediction generalization capabilities of message-passing gnns in larger test graphs. In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA… find
  48. Željko Ð. Vujovic. 2021. Classification model evaluation metrics. International Journal of Advanced Computer Science and Applications, 12(6). find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/wu-2026-cia-inferring-communication-topology-llm/