Technical Summary: When Latent Agents Lie: KV-Cache Integrity in Multi-Agent LLM Collaboration

1. Problem Statement

The paper addresses the integrity risks introduced by high-bandwidth latent memory in multi-agent Large Language Model (LLM) systems. As LLM serving architectures evolve to treat Key-Value (KV) caches as managed, transportable state objects, multi-agent protocols increasingly allow specialists to transmit full KV-cache states to a coordinator rather than just visible text.

While this "latent collaboration" enables richer evidence aggregation for split-evidence tasks (where no single agent holds all necessary information), it creates a critical vulnerability: KV-transport integrity. Unlike visible text commitments, which can be audited, the full KV state is opaque. A compromised specialist (or an on-path attacker) can substitute, rescale, or optimize the hidden KV state while maintaining a plausible visible commitment. The paper investigates whether standard text inspection, latent-state diagnostics, or transport checks can detect or mitigate these hidden manipulations.

2. Methodology and Experimental Setup

Protocol Architecture

The authors evaluate a role-sequenced multi-agent protocol consisting of:

• Planner: Assigns evidence partitions.
• Specialists: Receive specific evidence, emit a short visible commitment, and (in latent branches) transport a full KV-cache state.
• Verifier: Audits visible commitments and can filter specialists before their contributions reach the coordinator.
• Coordinator: Aggregates accepted information (text or full-KV) to generate the final answer.

Threat Model

The study defines three tiers of adversary capability regarding a compromised specialist:

• Tier A (Semantic): The attacker controls visible text and commitments but cannot manipulate hidden states.
• Tier B (Hidden-State Write): The attacker can overwrite or transform the latent KV state (e.g., random corruption, scaling, sign flips) without gradient access. The visible commitment remains plausible.
• Tier C (White-Box): The attacker has Tier B access plus gradient differentiation through the coordinator, allowing for adaptive, norm-matched attacks that evade simple statistical filters.

Benchmarks and Models

• Primary Benchmark: A transformed version of HiddenBench (65 records), designed for split-evidence reasoning where hidden information is distributed across specialists.
• Secondary Benchmarks: Full-validation HotPotQA (7,405 records) and a 100-record white-box slice.
• Models: Qwen/Qwen3-4B (primary) and Qwen3-8B (replication).
• Metrics: Exact Match (EM) and F1 scores, alongside latency and bandwidth measurements.

3. Key Contributions

1. Formulation of Transported-State Integrity: The paper frames full-KV latent collaboration as an empirical integrity audit, distinguishing between endpoint-generated malicious content and on-path transport tampering.
2. Empirical Capability/Risk Trade-off: A comprehensive evaluation comparing full-KV latent collaboration against matched text collaboration, local-only answering, and voting baselines.
3. Malicious-Specialist Evaluation: A separation of attacks into semantic steering (Tier A) and nonsemantic hidden-state corruption (Tiers B/C), including adaptive white-box attacks.
4. Latent Influence Diagnostics: A method to demonstrate that correct latent answers causally depend on specific specialists' hidden-state memories, and that malicious KV can mediate target steering.
5. Defense Analysis: An evaluation of visible filtering, magnitude quarantine, learned sanitizers, and a MAC-backed transport integrity mechanism.

4. Key Results

Clean Collaboration (Utility)

• Performance Gain: Full-KV latent collaboration consistently outperforms matched text collaboration in clean (non-adversarial) runs.
  • HiddenBench (Qwen3-4B): Latent EM/F1 reached 0.338/0.486 vs. Text 0.231/0.369. The F1 gain is statistically significant; the EM gain is directionally positive but statistically weaker.
  • Replications: Similar gains were observed on Qwen3-8B HiddenBench and the full HotPotQA set.
• Latency vs. Bandwidth: Latent collaboration reduces estimated parallel critical-path latency (2.379s vs. 3.009s) but incurs a massive bandwidth cost (~279 MB of KV cache per example vs. 0 MB for text).
• Causal Dependence: Influence mapping showed that removing an essential specialist flipped 10 of 21 latent-correct answers, confirming that the coordinator relies on specific hidden-state evidence.

Attack Results (Vulnerability)

• Nonsemantic Collapse: Random latent-thought corruption and scale-8 manipulation (Tier B) collapsed performance to near zero (EM/F1 ~0.000/0.000), flipping all clean-correct answers.
• Semantic Steering: Targeted false specialists (Tier A) steered the coordinator toward wrong answers, causing moderate degradation (EM/F1 0.231/0.386) but not total collapse.
• Adaptive Evasion: White-box, gradient-optimized norm-matched attacks (Tier C) successfully evaded magnitude quarantine. These attacks reduced EM/F1 from 0.323/0.471 to 0.077/0.119 while being rejected 0/65 times by statistical filters.
• Visible Filtering Failure: Verifier filtering based on visible commitments failed to detect hidden state corruption, often rejecting honest specialists while accepting malicious ones.

Defense Results

• Magnitude Quarantine: Successfully recovered utility for non-adaptive random and scale-8 attacks (restoring EM/F1 to ~0.338/0.476) but failed completely against adaptive white-box attacks.
• Learned Sanitizers: A calibrated learned sanitizer (reject-1 policy) failed to outperform a matched random-budget dropping strategy under detector-aware attacks, indicating that anomaly detection is brittle against adaptive adversaries.
• Transport Integrity (The Constructive Solution): The authors implemented an HMAC-SHA256 manifest binding specialist identity, session, model, visible commitment, tensor metadata, and payload digest.
  • Detection: It accepted 774/774 honest payloads and rejected 295/295 tampered payloads.
  • Recovery: Upon detecting transport failure, a "fail-closed" policy (dropping the unauthenticated KV state) restored performance. On HiddenBench, this recovered EM/F1 to 0.338/0.476 (vs. 0.006 for the attacked branch). On HotPotQA, it recovered to 0.450/0.592.

5. Significance and Claims

The paper concludes that high-bandwidth latent memory is a double-edged sword: it offers genuine capability gains for split-evidence reasoning but introduces a severe integrity liability that visible text auditing cannot close.

• Primary Claim: The constructive solution is not better anomaly detection (which fails against adaptive attacks) but transport-layer integrity. A cryptographic manifest (HMAC) effectively detects post-handoff KV substitution under an uncompromised transport key.
• Boundary of Protection: The proposed mechanism protects against on-path tampering of honest KV states. It explicitly does not protect against:
  • Compromised endpoints that sign malicious in-band KV.
  • Semantic malicious specialists who generate and sign their own malicious KV.
  • Remote attestation failures or key compromises.
• Modesty: The authors emphasize that their claims are bounded to the evaluated models (Qwen3), specific benchmarks (HiddenBench/HotPotQA), and the specific threat model of specialist compromise. They do not claim general robustness against all semantic attacks or production-scale deployment guarantees.

The work serves as a bounded empirical audit, demonstrating that while latent collaboration is powerful, its deployment requires explicit integrity boundaries (like MACs) rather than reliance on latent-state diagnostics or visible text verification.