MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication

2026-08-03

AI Summary

This work addresses the vulnerability of multi-agent large language model (LLM) systems to unintended disclosure of protected states during communication, where existing privacy mechanisms struggle to precisely govern what is disclosed and how it is subsequently used. To tackle this, the paper introduces the Minimal Necessary Communication (MNC) protocol—the first approach to integrate scope-bound, type-based semantic declassification into LLM agent communication. MNC employs a reference monitor to enforce fine-grained policies that constrain the recipient, purpose, forwarding, lifetime, logging, and memory retention of disclosed information. Coupled with history-aware reasoning for risk assessment, MNC provides composable privacy guarantees. Experimental results demonstrate that MNC effectively prevents unauthorized forwarding, logging, persistent storage, and stale retrieval while preserving task utility, ensuring secure propagation of disclosed information across planning, tool invocation, and memory operations.

Abstract

Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream. We introduce Minimum-Necessary Communication (MNC), a typed semantic-declassification protocol that selects a task-sufficient disclosure from an application-authored candidate family and binds it to explicit recipient, purpose, forwarding, lifetime, logging, and memory scopes. A reference monitor enforces these scopes across subsequent operations, while a history-aware extension accounts for inference risk accumulated over repeated disclosures. Controlled semantic-join, memory, probing, and longitudinal experiments show that conventional defenses can preserve protocol-level utility while exposing substantial additional inference signal. Under identical receipt text, MNC preserves authorized delivery while blocking unauthorized forwarding, logging, durable storage, and retrieval after expiration that a text-only semantic declassifier permits. Two-backbone MAGPIE executions further show that mediated disclosures propagate through subsequent planning, tool use, coordination, and memory retrieval. These results support scope-bound semantic declassification as a practical communication boundary for private LLM-agent systems.

Problem

• privacy
• semantic declassification
• LLM agents
• information disclosure
• scope-bound communication

Innovation

• semantic declassification
• minimum-necessary communication
• scoped disclosure
• reference monitor
• multi-agent LLM