CIA Attack Steals AI Agent Wiring Diagrams Using Just Clever Prompts
A new black-box attack reconstructs the hidden agent graph inside LLM multi-agent systems with AUC up to 0.99, exposing IP and attack surfaces.
PRO- New black-box attack CIA reconstructs the hidden communication graph of LLM multi-agent systems from final outputs only.
- Reaches average AUC 0.87 and peak 0.99 across G-Designer, AGP, and ARG-Designer topologies on four benchmarks.
- Stage one uses three prompt constraints to force the final response to leak every intermediate agent's reasoning.
- Stage two applies Global Bias Disentanglement plus LLM-guided weak supervision to filter spurious embedding similarity.
- Sparser topologies leak more; ARG-Designer graphs on GSM8K and SVAMP are inferred with near-perfect accuracy.
- Code released at github.com/aabbbcd/CIA; paper on arXiv.
A team from the Chinese Academy of Sciences, Griffith University, and NTU has shown that the internal wiring of an LLM-based multi-agent system, meaning which agent talks to which, can be reverse engineered from the outside using nothing more than carefully written prompts. Their attack, called Communication Inference Attack (CIA), reaches an average AUC of 0.87 and peaks at 0.99 on setups built with state-of-the-art topology optimizers.
The communication graph is the part of a multi-agent system that took the most engineering to design, and it is also the part that tells an attacker where to strike.
Why the graph is the crown jewel
Modern LLM multi-agent systems (MAS) coordinate several specialized agents through a directed acyclic graph that decides who reads whose output. This topology governs how information flows internally, and its security has drawn growing attention. Recent frameworks like G-Designer, AGP, and ARG-Designer use graph neural networks or autoregressive generation to build task-specific topologies that outperform handcrafted chains and stars.
Two things make that graph sensitive:
- Vulnerability exposure. Knowing the topology lets an adversary pick the exact agent whose jailbreak will cascade furthest through the pipeline.
- IP theft. An optimized graph encodes the developer's tuning work and compute spend. Leaking it is closer to leaking model weights than leaking a prompt.
Prior attack literature has mostly focused on injecting toxic content or misinformation across agents. The novelty here is treating the topology itself as the secret to steal, under a strictly black-box setting where the attacker only sees the system's final response.
Making the system leak its own scratchpad
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
