From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability

Abstract: Agent-interoperability protocols such as A2A and MCP standardize what agents say to one another, but assume address-based transport over HTTP(S). Such transports protect message content, increasingly with end-to-end encryption. What they leave in the clear is the communication graph: which agent contacts which, when, and how often. In agent systems this graph is more consequential than a privacy framing suggests. Endpoints are often capability-labeled, workflows are structured and chained, and interactions are coupled to real actions, so an observer recovers more than past relationships. It can infer the pending workflow, the task being assembled and the action likely to follow. At machine speed, it can act on that inference before the workflow completes. The threat is therefore one of workflow integrity, not privacy alone: predictive leverage over autonomous action. We give a threat model for the agent communication graph; identify what makes agent metadata distinctively revealing (semanticity, prospectivity, actuation); define transport- and bootstrap-layer privacy properties and weigh candidate transports (SimpleX/SMP, Tor, mixnets) against them; and present an A2A case study in which a metadata-protecting binding is expressible but surfaces the protocol's identity assumptions. We test these on a generative model anchored to a real A2A capture. From passive metadata alone, with no payloads, a classifier recovers a task's class well above chance, from only the workflow's opening; applied together, the properties drive that recovery sharply back toward chance. Beyond what an observer can recover, we measure the leverage of acting on the leak: from a workflow's opening and under a fixed budget, an adversary choosing which workflows to act on realizes in this model most of a clairvoyant attacker's advantage over a metadata-blind one, and the same properties suppress it.

• The paper demonstrates that exposed agent communication metadata can jeopardize workflow integrity despite strong content encryption.
• It establishes a threat model grounded in semanticity, prospectivity, and actuation, and validates the risks through controlled empirical analyses.
• A case study on A2A protocols shows that combining unlinkability and metadata minimization is essential for mitigating adversary advantages.

Communication-Graph Metadata Risks and Protections in Agent Interoperability

Overview

This paper rigorously demonstrates that the communication graph—metadata detailing which autonomous agents interact, when, and how—remains persistently exposed in agent interoperability protocols such as A2A and MCP, even under strong content encryption. The analysis establishes that this metadata is not merely a privacy concern but directly impacts the integrity of agent workflows by providing adversaries with prospective, actionable knowledge of tasks in progress. The work formalizes the metadata threat model, identifies unique properties of agent communication metadata, provides a systematic framework for evaluating transports against metadata-leakage properties, presents an A2A case study, and substantiates claims with controlled empirical analyses.

Agent-Interop Metadata Threat Model

Conventional agent-interoperability protocols (A2A, MCP) assume message confidentiality but maintain address-based routing, leaving the underlying communication graph exposed to multiple adversary classes (network observers, intermediaries, registries, colluding endpoints). Such exposure enables passive recovery not only of historical relationships but also of ongoing, nascent workflows, especially when agents and endpoints are semantically labeled by capabilities.

The paper distinguishes between payload secrecy and metadata exposure, clarifying that content encryption does not adequately address the attack surface presented by the transport-level metadata. Definitions and adversary models are provided for clarity, highlighting the independence between content and metadata protection.

Figure 1: Task class recovered from communication-graph metadata, by adversary view ($K=8$ classes, chance $0.125$); even label-blind network observers recover task class far above chance.

Unique Properties of Agent Communication Metadata

The authors identify three axes of distinctiveness for agent communication metadata:

• Semanticity: Endpoints correspond to meaningful capabilities, so observing communication reveals task/intent semantics.
• Prospectivity: Workflows exhibit structured, sequential patterns, permitting prediction of future steps early in execution.
• Actuation: Agent interactions may trigger immediate, real-world actions, making metadata-derived inferences directly actionable.

These properties mean that the observed communication graph can reveal and thus allow adversaries to strategically interfere with tasks prior to their completion.

Figure 2: Prospective leakage—network view predicts the pending task class well above chance from only the opening fraction of each workflow.

Privacy Properties and Transport Evaluation

A comprehensive set of privacy properties is articulated, covering both transport and bootstrap layers:

• Unlinkability: No persistent mapping between observed interaction identifiers and agent identities.
• No Central Observer: No adversary or intermediary has a global view of the graph without collusion.
• Deniability: Interactions do not yield non-reputable transcripts.
• Metadata Minimization: Reducing timing, length, and directionality cues.
• Discovery Privacy: Concealment of capability lookups and bootstrap interactions from central registries or intermediaries.

These properties are evaluated against real-world transports (SimpleX/SMP, Tor, mixnets) and typical agent transports (HTTP(S), SLIM). No existing system provides all properties at low latency; for example, SMP is strong on unlinkability but only partial on traffic analysis resistance, and mixnets approach ideal but with high latency.

Protocol Case Study: Addressing Metadata in A2A

Through a concrete binding of A2A to an identity-less, privacy-oriented transport (SimpleX/SMP), the paper surfaces implicit protocol assumptions:

1. Push notifications presume HTTP-reachable endpoints.
2. Authentication is tightly coupled to persistent identity.
3. Discovery assumes resolvable, fixed endpoints.

Two are addressable via remapping to asynchronous, invitation-based mechanisms; authentication necessitates a shift to credential-/capability-based trust, decoupled from persistent identity. This work clarifies where protocol semantics fundamentally intertwine with transport-level metadata, informing potential standardization and protocol redesign efforts.

Empirical Evaluation: Quantifying Leakage and Actuation Value

A generative model for agent workflows (anchored to real A2A traces) is used to assess the recoverability of workflow/class information from passive metadata. Results establish that:

• Network-level adversaries recover task classes at 0.99 accuracy (for $K=8$), with significant accuracy (0.70) achieved from just the first 10% of workflow messages.
• Individual privacy properties (unlinkability, metadata minimization) do not significantly reduce leakage; only their combination drives recovery sharply toward chance.
• The registry observer is only checked by discovery privacy, demonstrating the orthogonality of metadata channels.

  Figure 3: Accuracy under each privacy property/adversary view; only the combination of unlinkability and metadata minimization suppresses network-view leakage, discovery privacy solely curtails registry observers.

To move from inference to real-world implications, the paper introduces the actuation game (quantifying the value of metadata to an adversary acting under a fixed budget to select targeted workflows). The adversary, from a short workflow prefix, captures most of the attainable value over a baseline without metadata access, demonstrating that leakage is not only observable but actionable.

Figure 4: Actuation/capture ratio by privacy property; only the combined wire properties collapse adversary leverage to the blind baseline.

Figure 5: Left—Capture ratio against decision deadline: leverage is substantial from early workflow prefixes, only the full wire protection suppresses it. Right—Value of metadata as a function of attack budget; maximal advantage at intermediate budgets.

Practical and Theoretical Implications

The findings delineate the boundaries of feasible privacy/integrity protections in agent interoperability. Key implications include:

• Protocol Design: Achieving workflow-integrity protection requires both unlinkability and metadata minimization. Discovery privacy must also be integrated to neutralize registry-driven attacks.
• Trust and Reputation: Classic, graph-based reputation mechanisms fundamentally conflict with unlinkability; credential-based or pairwise alternatives are viable.
• Deployment Considerations: Incremental adoption of metadata-protecting bindings is feasible via protocol extension points without breaking compatibility, enabling sensitive deployments in regulated or competitive environments.
• Future Work: Live-wire deployment, field-scale actuation studies, and tighter formalization of adversary-indistinguishability for metadata properties remain open research problems.

Conclusion

The exposure of the agent communication graph in today's interoperability stacks provides adversaries with potent predictive and actionable leverage, threatening the integrity—not only the privacy—of autonomous workflows. Only concerted application of multiple privacy properties at both transport and bootstrap layers can neutralize this risk. This work rigorously characterizes the scope of the problem, provides actionable properties for mitigation, validates claims empirically, and clarifies implications for agent protocol evolution, deployment, and the future of trustworthy agentic infrastructurs.