Checking privacy at each handoff is not enough, because information changes as it flows downstream, and task-graph checks cut unauthorized disclosures 85.8-94.1 percent
AspireAI community · arXiv (cs.CR)
Multi-agent systems with persistent memory and inter-agent messaging create privacy risk that a per-message check cannot see, because a disclosure that is fine in isolation can become inappropriate once combined with what a recipient already knows or once it propagates downstream along the planned workflow. Task-Graph Contextual Integrity (TG-CI) is described as the first task-graph-native formalization of Contextual Integrity for multi-agent systems, representing a workflow as a Multi-Agent Task Graph and extending Contextual Integrity from atomic transfers to stateful graph-level flows by weighing an item's intended propagation scope against recipients' evolving disclosure states, enforced through two policies, Full-Scope and Auto-Region. With a new 144-case benchmark, MAPLE-Bench, that varies graph topology, disclosure history, compromised-agent placement and item-level policies, TG-CI reduced mean unauthorized disclosure counts by 85.8-94.1 percent relative to a local-history baseline while retaining 93.6-96.1 percent of that baseline's task accuracy. The limitation: the benchmark is synthetic and small, the enforcement policies give different privacy-cost-utility trade-offs rather than one clear winner, and grounding the belief state without false positives remains the open implementation problem.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.