Trust-Aware Adaptive Disclosure for Inference Privacy Preservation in Multi-Agent Networks

The study addresses privacy-preserving communication in multi-agent systems where agents have observable states and private latent goals, and where a passive adversary can observe part of the communication history and knows the protocol and network topology. Its objective is to use receiver trust information to adjust communication strategies so that inference of private goals is reduced while task utility and communication efficiency are maintained. The defined setting uses an undirected communication graph, trust scores derived from communication reliability and behavioral consistency, and a strategy that can access those scores. The theoretical treatment is limited to fixed noise variance, a simplified instantaneous communication model, and an AWGN approximation.

Trust-Aware Privacy Control (TAPC) forms a link-level sequence from reliability and behavioral consistency to a dynamic trust score, then to a continuous disclosure coefficient, and finally to a mixed message. In the stated formulation, the coefficient is a trust-dependent power function, and the message mixes a task-related feature with a Gaussian masking signal. Lower-trust links are intended to receive more masking, while higher-trust links retain more task-related information. The paper places this mechanism within an objective that minimizes average inference leakage subject to task-utility and communication-cost requirements. Under fixed noise variance, positive sensitivity, the stated trust range, and the instantaneous AWGN approximation, its analysis derives a monotonic relation from disclosure to signal-to-noise ratio and a single-link capacity upper bound. The evaluation material characterizes this as a method-level structural increment: trust, continuous disclosure control, and random message generation form a new link-level control path rather than merely adding a label or parameter.

The paper reports experiments with N=50 agents, T=100 communication steps, statistical history features, and a random-forest inference model. Against full disclosure, uniform Gaussian noise, and trust-threshold communication, it claims lower target-inference leakage, competitive consensus utility, and equal communication cost under the reported setting. The frozen evaluation supports the existence of an executable trust-aware disclosure mechanism and a conditional local analytical relation. It does not, however, treat the reported classifier result as a guarantee for arbitrary passive adversaries, nor does it treat a single-link capacity upper bound as an established reduction in the actual mutual information or inference probability of the observed history. The evidence therefore supports a bounded, local advance in mechanism design and analysis, while leaving the broader privacy–utility control objective unresolved.

The central analytical chain closes only from disclosure to single-link signal-to-noise ratio and a capacity upper bound. The materials identify several unresolved links before this can establish reduced inference from the adversary’s actual communication history. The model does not establish that trust scores correspond to the links observed by the adversary or correctly rank leakage risk. Shared notation for noise across links and the feedback from messages to later trust scores also leave cross-link, cross-time dependence and stability unproved. The random-forest result is an experiment-specific surrogate and does not by itself establish a bound for stronger inference models or for the stated general inference quantity. The reported communication-cost comparison is not fully connected to the bit-count definition because message dimensionality, quantization, coding, and the realized graph size are not specified. The progress review further notes that historical aggregation, joint utility guarantees, and communication constraints are not fully closed. Time-dependent models, historical information aggregation, time-varying directed graphs, alternative perturbation mechanisms, stronger privacy or convergence guarantees, and real deployment are presented as future work rather than established results.