Large language model (LLM)-based multi-agent systems increasingly rely on intermediate communication to coordinate complex tasks. While most existing systems communicate through natural language, recent work shows that latent communication, particularly through transformer key-value (KV) caches, can improve efficiency and preserve richer task-relevant information. However, KV caches also encode contextual inputs, intermediate reasoning states, and agent-specific information, creating an opaque channel through which sensitive content may propagate across agents without explicit textual disclosure. To address this, we introduce \textbf{LCGuard} (Latent Communication Guard), a framework for safe KV-based latent communication in multi-agent LLM systems. LCGuard treats shared KV caches as latent working memory and learns representation-level transformations before cache artifacts are transmitted across agents. We formalize representation-level sensitive information leakage operationally through reconstruction: a shared cache artifact is unsafe if an adversarial decoder can recover agent-specific sensitive inputs from it. This leads to an adversarial training formulation in which the adversary learns to reconstruct sensitive inputs, while LCGuard learns transformations that preserve task-relevant semantics and reduce reconstructable information. Empirical evaluations across multiple model families and multi-agent benchmarks show that LCGuard consistently reduces reconstruction-based leakage and attack success rates while maintaining competitive task performance compared to standard KV-sharing baselines.

翻译：基于大语言模型的多智能体系统日益依赖中间通信来协调复杂任务。尽管现有系统主要通过自然语言进行通信，但近期研究表明，潜在通信（特别是通过Transformer键值缓存实现）可提升效率并保留更丰富的任务相关信息。然而，KV缓存同时编码了上下文输入、中间推理状态及智能体专属信息，构建出敏感内容可在智能体间传播而无需显式文本披露的不透明通道。为此，我们提出\textbf{LCGuard}（潜在通信防护框架），用于实现多智能体LLM系统中安全的KV潜在通信。LCGuard将共享KV缓存视为潜在工作记忆，并在缓存制品跨智能体传输前学习表征级变换。我们通过重构操作来形式化表征级敏感信息泄漏：若对抗解码器可从中恢复智能体专属敏感输入，则共享缓存制品不安全。这引出对抗训练范式——攻击方学习重构敏感输入，LCGuard则学习保留任务相关语义并降低可重构信息的变换。跨多模型家族与多智能体基准的实验表明，相较标准KV共享基线，LCGuard在保持竞争性任务性能的同时持续降低基于重构的信息泄漏与攻击成功率。