Research map / Multi-agent systems and games / LLM agents

Whispering Agents: A Event-Driven Covert Communication Protocol for the Internet of Agents

AAAI 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Formalizes a Covert Event Channel (storage, timing, behavioral) for Internet of Agents and proposes Π_CCAP, a hybrid steganographic A2A dialogue protocol evaluated on capacity, robustness, and detectability by a BERT steganalyzer and a GPT-4o judge.

Problem

Agent-to-agent communication protocols encrypt message content but leave the act of communication visible to traffic analysis; existing covert/steganographic methods target static artifacts and do not handle multi-turn agent dialogues.

Approach

Treat an event-driven agent dialogue as a hybrid covert channel: provably secure generative steganography in payloads (storage), key-dependent timestamp selection (timing), and context-aware action-type selection (behavioral), with a handshake, header-based fragmentation, and implicit timing-based acknowledgments.

Key results

• Correctness: all transmitted secret messages decoded successfully with 100% checksum and hash verification across configurations.
• Discop with Llama3 at 1024-bit payload on Art topic reaches EBPR 80.03 and BPR 97.97; Philosophy topic yields EBPR up to 89.72.
• BERT steganalyzer on art test set achieves AUC 0.503 (near random), with precision 0.250 and F1 0.333.

Surprising findings

• The paper reports covert capacity in bits per conversation while comparing against bits per sentence for stego baselines, making direct comparison of capacity numbers non-uniform.

Limitations

• Evaluation limited to conversational text; multimodal and richer action spaces not tested.
• Assumes stable natural behavior distribution and passive adversary.
• No rigorous compositional proof across storage, timing, and behavioral channels; baselines and ablations limited.

Experimental setup

Datasets: Paired stego/benign dialogue corpus generated by the authors (Art, Philosophy, General QA prompts)

Benchmarks: Authors' covert dialogue corpus (Art, Philosophy, General QA topics)

Metrics: BPR EBPR Entropy AUC Precision F1 Naturalness Coherence Suspicion score

Baselines: Discop Differential-based steganography Secret Collusion A2A

Builds on: Discop Differential-based steganography A2A protocol Secret Collusion

Closest papers by meaning

• Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS (AAAI 2026 · similarity 0.83)
• Searching for Privacy Risks in LLM Agents via Simulation (ICLR 2026 · similarity 0.82)
• T2MAC: Targeted and Trusted Multi-Agent Communication through Selective Engagement and Evidence-Driven Integration (AAAI 2024 · similarity 0.81)
• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems (ICML 2026 · similarity 0.81)
• The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems (NeurIPS 2026 · similarity 0.81)
• Cut the Crap: An Economical Communication Pipeline for LLM-based Multi-Agent Systems (ICLR 2025 · similarity 0.81)