Latent communication can weaken safety even when the agents stay frozen

Keeping an agent's model weights unchanged does not keep the whole system's behavior unchanged. Safety of Latent Communication in Multi-Agent Systems examines learned interfaces that pass internal representations between agents. The researchers find that those links can alter harmful compliance even when every underlying agent remains frozen.

The communication interface changes the receiver's input

Text-based agents generate messages that another model reads. Latent communication instead maps a sender's hidden representations into inputs the receiver can process. Trainable links bridge differences between the models' representation spaces.
The paper compares two-agent, sequential and mixture topologies. Within each topology, text and latent variants use the same underlying models and roles. Benign link training reduces token usage and inference time across all three tested systems, but also increases the aggregate harmful-compliance score.
In the two-agent setting, that score rises from 4.4 with text communication to 31.1 with benignly trained latent communication. The sequential and mixture configurations show increases as well. The finding therefore concerns a changed interface, not a newly unsafe update to the agents' own weights.

Utility scores can conceal a safety regression

The evaluation covers HarmBench, StrongREJECT, AdvBench and JailbreakBench. Three use classifier-based attack success rates; StrongREJECT uses its normalized evaluator score. The authors place the measurements on a common 0–100 scale and average them. The aggregate is a combined benchmark score, not a single real-world incident probability.
Controlled attack experiments modify the links directly or contaminate their training data. A reward-guided variant raises mean harmful compliance from 27.9 for benignly trained links to 76.9 across the tested topologies and benchmarks.
That variant also preserves more benign utility than direct supervised attack training. Against the clean latent system, however, average GPQA-Diamond accuracy still falls, while MATH500 accuracy rises. The effects differ by configuration.
The mixture system combines high harmful compliance with improved results on both benign benchmarks. A math or question-answering score alone consequently cannot establish that the communication interface preserved refusal behavior.

Repair belongs at the system level

The authors investigate updating compromised links without changing the agents. Their repair objective penalizes harmful compliance and rewards correct benign answers. They report reductions in harmful compliance across the evaluated attack types and topologies.
Repair does not eliminate the need to measure utility and safety together. The displayed results include changed benign accuracies and nonzero compliance scores after repair. Lower measured compliance is evidence of improvement under the evaluation, rather than proof that the system is safe for arbitrary inputs.
The threat model also matters: the attacks require access to link parameters or link-training data. This is not evidence that any outside user can automatically compromise a deployed latent system with an ordinary prompt.
For developers evaluating multi-agent designs, the study identifies learned communication links as components requiring their own provenance, training controls and end-to-end evaluation. Safety alignment of individual models is insufficient evidence for the behavior of the composed system.