LCGuard Explained: Can Shared AI Memory Keep Private Inputs Private?

An AI agent can avoid saying a secret while passing numerical working memory that still exposes it. LCGuard learns transformations on shared transformer key/value tensors to balance task utility against reconstruction-based leakage. Exact citation: Sadia Asif, Mohammad Mohammadi Amiri, Momin Abbas, Prasanna Sattigeri, and Karthikeyan Natesan Ramamurthy. LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems. arXiv:2605.22786v1, 21 May 2026. https://arxiv.org/abs/2605.22786v1 All 26 PDF pages, including appendices A.1-A.10 and references, were read. PDF SHA-256: 62aecc1dc06f759511eb086d728fd0da2300d862c970c3dda26c9a63c8081353. Matched the exact versioned arXiv PDF byte-for-byte. We explain token count by key/value width, final-layer token-wise layer normalization, down-projection, GELU, up-projection, and residual addition. The narrow correction is not a secrecy guarantee: the original vector bypasses it. The 4096-width, quarter-width example has 16,777,216 projection weights, excluding biases and normalization parameters; implementation-specific head layouts remain unspecified. The hard maths: reconstruction negative log likelihood versus a no-artifact prior; normalized reconstruction advantage; task loss minus beta times reconstruction loss; minimax signs; what stays fixed and what learns; local versus complete-stream observation. Invented residual, loss-ratio and competing-filter calculations are checked illustrations, not measured model behavior or experiments. The described algorithms update communication and diagnostic decoder parameters, not backbone weights. At deployment decoders are discarded. Authors' Table 1, Qwen3-4B, four sequential agents, PrivacyLens: raw ASR 0.871 versus full-system 0.216; Task 0.720 versus 0.710; Helpfulness 0.780 versus 0.710. ASR falls 65.5 percentage points, about 75.2 percent relative to the rounded baseline. These are not universal reductions. ASR averages binary judge decisions of semantic reconstruction success over evaluation instances for a target agent. Cross-agent pooling is not fully specified. Privacy is a separate benchmark score; Leak is defined as 1 minus Privacy, not ASR. Controls and limits: methods share topology, agent configuration and splits, but not equal helpfulness. The appendix reports held-out decoder evaluation and three-run averages. Selected decoder strengths do not establish robustness to every future decoder, side information, shifted population or heterogeneous model. Table 5 stronger diagnostic capacity raises ASR from 0.285 to 0.365 at beta 0.25. Table 8 Qwen3-14B sequential MAGPIE: ASR 0.855 to 0.260, helpfulness 0.840 to 0.780. Table 10 normalized latencies: text 1.00, raw 0.24, LCGuard 0.28; the latter adds about 16.7 percent over rounded raw latency. Source caveats: Equation 8 prints a plus reconstruction-loss sign, conflicting with the goals and Algorithms 1-2 minus signs. Our minimax explanation follows the algorithms and discloses that interpretation. Equation 15 increases with reconstruction advantage, whereas tables label higher reconstruction difficulty as better; we do not silently correct the source. Some Privacy/Leak complements, agent counts, model context and cross-table beta scores are inconsistent. Split wording, judge details and implementation details are incomplete; see accompanying source notes for exact examples. Do not merge separate table rows into a reproduced unified experiment. No experiments independently reproduced. Defensive educational analysis only, without extraction code or attack implementation. Harder reconstruction is NOT information-theoretic secrecy or differential privacy; the paper explicitly provides no formal privacy guarantee. Combine representation filtering with data minimization, access controls, logging safeguards and output privacy checks. #LCGuard #AIResearch #Privacy #MultiAgentSystems