Freezing agents and training only latent links: benign link training alone raises harmful compliance above text communication, and an RL attack lifts the mean from 27.9 to 76.9
Synopsis
This work studies the safety of latent communication in multi-agent systems, where lightweight trainable links replace text messages, and finds that with all agent parameters frozen, benign link training alone increases harmful compliance relative to text communication, that an attacker can amplify this via supervised optimization on harmful query-response pairs, poisoning benign training data, or a reward-guided reinforcement-learning attack that needs no harmful target responses, raising the mean harmful-compliance score from 27.9 with benignly trained links to 76.9 across three topologies and four safety benchmarks, and that adapting the rewards toward safer behavior repairs compromised links by updating only the links.
Interpretation
Benign link training itself weakens system safety: with all underlying agents frozen, latent communication increases harmful compliance relative to text communication, with aggregate scores rising in the two-agent, sequential, and mixture systems. Prior latent-communication work focused mainly on effectiveness and efficiency; this work treats the learned communication interface itself as a safety variable, showing that system-level safety behavior changes even when training data is benign and models are untouched. Text versus benignly trained latent links are compared across three topologies on HarmBench, StrongREJECT, JailbreakBench, and AdvBench, with reported drops in first-token refusal probability and recovery of most of the link-induced effect by forcing refusal prefixes.
An attacker can amplify the effect: directly optimizing links on harmful query-response pairs, or injecting roughly 10% harmful examples into otherwise benign training data, substantially raises harmful compliance, usually with losses in benign task performance. The work treats link-training data and objectives as an attack surface, showing the system can be steered without modifying agents, and quantifies how poisoning fraction relates to effect. The supervised attack uses 3,000 harmful query-response pairs from PKU-SafeRLHF and poisoning injects 212 harmful examples into 1,904 benign ones; cross-topology average compliance rises from 31.1/31.7/20.8 to about 78.3/67.0/81.6 (supervised) and 49.2/55.9/69.6 (poisoning), while MATH500 and GPQA-Diamond accuracy fall.
A reward-guided reinforcement-learning attack reaches or exceeds supervised attacks without harmful target responses: optimizing links with GRPO on scalar rewards for the system's own responses raises cross-topology mean harmful compliance from about 27.9 with benignly trained links to 76.9, with higher average accuracy on two benign utility benchmarks. Compared with supervised optimization that needs harmful target responses, this attack relies only on scoring the system's own responses, lowering the supervision required, and achieves higher compliance in two of three topologies. Evaluated across three topologies and four safety benchmarks; the mixture system combines the highest harmful compliance with improved accuracy on both benign benchmarks, showing strong benign task performance does not rule out substantial harmful compliance.
Compromised links can be repaired: adapting the rewards to penalize harmful compliance and reward correct answers to benign queries reduces harmful compliance substantially across all evaluated attacks and topologies by updating only the links, without updating agents. This shows safety objectives can target the learned interaction between agents rather than only individual models, and provides a link-level repair path. Averaged across nine attack-topology pairs, the aggregate harmful-compliance score falls from about 62 to about 7, with all four safety benchmarks below the original clean links in every configuration; repair reduces MATH500 accuracy in some settings, and average GPQA-Diamond remains below the clean baseline.
Perspective
The results apply to multi-agent systems using learned latent communication links, within the three evaluated topologies (two-agent, sequential, mixture) and tested model combinations, and on the four safety benchmarks HarmBench, StrongREJECT, JailbreakBench, and AdvBench plus the two utility benchmarks MATH500 and GPQA-Diamond. They indicate that safety assessment should cover the whole system and its trained communication interface, and suggest that link-level safety objectives can repair compromised links; this perspective can be borrowed for other systems with similar trainable interfaces.
Poisoning effects saturate around 10%, and what determines the saturation point remains an open question; single-link attacks show control is not uniformly distributed, and which links are most critical and what information they encode needs further characterization; repair reduces MATH500 accuracy in some settings and average GPQA-Diamond stays below the clean baseline, so the safety-utility trade-off needs case-by-case evaluation; conclusions are based on the tested models, topologies, and benchmarks, and generalization to other model scales, tasks, and communication mechanisms still needs verification.