When Eavesdroppers Reason: Agentic Eavesdropping Attacks on Semantic Communication

Technical Summary: When Eavesdroppers Reason: Agentic Eavesdropping Attacks on Semantic Communication

Problem Statement
Semantic communication (SemCom) offers significant efficiency gains for 6G networks by transmitting task-relevant semantic information rather than raw bits. However, its typical end-to-end joint source–channel coding (JSCC) architecture creates severe privacy vulnerabilities. Unlike traditional systems where bit-level encryption is feasible, SemCom's continuous, quantization-free nature makes direct encryption difficult. Furthermore, conventional physical-layer security (PLS) methods, which rely on channel advantages between legitimate and eavesdropping links, may be insufficient.

Existing research on eavesdropping attacks against SemCom has demonstrated that attackers can recover source information even at low Signal-to-Noise Ratios (SNR). However, current attack models suffer from two critical limitations:

1. Fixed Configuration: They rely on handcrafted solvers with rigid configurations tailored to specific channel conditions.
2. CSI Dependency: They often assume the eavesdropper possesses instantaneous Channel State Information (CSI) of the wiretap channel. In practical scenarios, an eavesdropper (Eve) may only know the statistical distribution of the channel, not the instantaneous state.

It remains unclear whether a "CSI-agnostic" eavesdropper can still cause severe privacy leakage, potentially leading future secure SemCom designs to overlook significant risks.

Methodology: Agentic Eavesdropping Framework
To address these limitations, the authors propose an LLM-orchestrated agentic eavesdropper. This framework reformulates the eavesdropping attack from a static optimization problem into a closed-loop, sequential decision-making process driven by three specialized agents:

1. Optimization Agent:

   • Role: Performs joint semantic-and-channel inversion to recover private information from intercepted signals without requiring instantaneous wiretap CSI.
   • Mechanism: It manages multiple independent, resumable "sessions" (trajectories) to solve the bilinear inverse problem. It utilizes three update modes: Image-only, Channel-only, and Joint.
   • Adaptivity: Based on signal residuals and feedback, the agent can continue a session, switch update modes, roll back to previous checkpoints, or terminate stagnant sessions and branch out (inspired by the "tree-of-thoughts" paradigm) to escape poor local minima.

2. Perception Agent:

   • Role: Evaluates the quality and semantic plausibility of intermediate reconstructions without access to the ground-truth source image.
   • Mechanism: It employs a Mixture-of-Experts (MoE) approach combining:
     • No-Reference Image Quality Assessment (NR-IQA): Tools like NIQE and TOPIQ-NR for fast, gradient-free quality estimation.
     • Multimodal LLM: A visual understanding expert that inspects the image for semantic coherence (e.g., presence of a face, completeness of features, absence of artifacts) and outputs structured evidence in JSON format.
   • Feedback: It fuses these scores to provide a "perception score" that guides the optimization agent in selecting promising candidates.

3. Refinement Agent:

   • Role: Enhances promising but degraded candidates using external generative priors while maintaining consistency with the intercepted signal.
   • Mechanism: It uses the multimodal LLM to generate a structured description of the candidate's visual attributes. This description forms a "restoration prompt" for a generative model (e.g., Stable Diffusion variants) to produce a photorealistic candidate.
   • Consistency Check: The refined candidate is not accepted immediately. It is fed back to the optimization agent to "warm-start" a new session. The agent verifies if the refined image remains consistent with the intercepted signal (low residual) and semantically valid. If the generator hallucinates content not present in the signal, the session is rolled back.

Key Contributions

• Agentic Attack Paradigm: The paper introduces the first agentic eavesdropping framework for SemCom, moving beyond fixed solvers to an adaptive, reasoning-based attack model.
• CSI-Agnostic Capability: The framework is designed to operate effectively without instantaneous wiretap CSI, relying instead on statistical channel knowledge and adaptive optimization.
• Closed-Loop Workflow: The integration of optimization, perception (using LLMs as judges), and refinement (using generative priors) creates a robust loop that balances signal fidelity with semantic realism.
• Privacy Risk Assessment: The study provides a rigorous evaluation of privacy leakage under practical constraints, challenging the assumption that lack of instantaneous CSI protects SemCom systems.

Simulation Results
The framework was evaluated on the FFHQ dataset over a 2x2 MIMO Rayleigh fading channel with SNR ranging from 0 to 20 dB.

• Performance: The proposed agentic eavesdropper achieved a Face Privacy Eavesdropping Success Rate (FPESR) of over 75% at SNR ≥ 5 dB, even without wiretap CSI.
• Comparison: It significantly outperformed glass-box Model Inversion Attacks (MIA) baselines (both with and without CSI). While MIA baselines struggled to recover recognizable faces at low SNR (0 dB), the agentic approach achieved 30–50% FPESR.
• Visual Quality: At SNR = 5 dB, the agentic eavesdropper reconstructed faces with high identity, pose, and attribute accuracy, closely matching the legitimate receiver (Bob). In contrast, conventional MIA produced noisy, distorted images, and a generative-only ablation (without agentic control) introduced hallucinated content that deviated from the source identity.
• Robustness: The agentic approach without CSI nearly matched the performance of its CSI-aware counterpart, demonstrating that the adaptive control loop effectively compensates for the lack of instantaneous channel information.

Significance and Claims
The paper claims that the proposed agentic eavesdropper reveals a severe and previously overlooked privacy threat in Semantic Communication. By demonstrating that an attacker can achieve high-fidelity recovery without instantaneous CSI, the authors argue that future secure SemCom designs cannot rely on the assumption that channel uncertainty or the lack of instantaneous CSI provides sufficient protection. The work underscores the necessity for new defense mechanisms that account for agentic, reasoning-based adversaries capable of leveraging generative priors and adaptive optimization.