Hidden KV-Cache Sharing in Multi-Agent LLMs Creates Security Risks

A new paper from Luis Brito and Carlos Baquero exposes a critical security flaw in multi-agent LLM collaboration: when agents share their full KV-cache state (beyond just text messages), malicious actors can stealthily corrupt the hidden state while leaving visible text seemingly harmless. The study tested Qwen3-4B and Qwen3-8B on HiddenBench and HotPotQA, showing that latent collaboration via KV-cache boosted exact match (EM) from 0.231 to 0.338 and F1 from 0.369 to 0.486 compared to text-only collaboration—proving the technique's genuine utility.

However, the same hidden channel opens the door to undetectable attacks. A malicious specialist can send a plausible-looking text commitment while altering its KV-cache state to mislead the coordinator. Simple magnitude checks catch obvious tampering but fail against adaptive attacks. The researchers' most reliable defense: treat KV-cache as a security-sensitive object and protect it in transport with an HMAC-SHA256 manifest that binds specialist identity, session, model, visible commitment, tensor metadata, and payload digest. This mechanism accepted all 774 honest replayed payloads and rejected all 295 recorded tampered payloads.