GAMA: Privacy-Preserving Multi-Agent System

• General Anonymizing Multi-Agent System is a framework that separates processing into private and public spaces to protect sensitive data during LLM task execution.
• The system employs an AMPP module for privacy detection, while DRKE and DLE modules recover semantic integrity and reinforce logical consistency after anonymization.
• Empirical evaluations show significant performance improvements over baselines along with extremely low re-identification success rates, ensuring robust privacy protection.

General Anonymizing Multi-Agent System (GAMA) denotes a privacy-preserving multi-agent framework for LLM-based task solving in which sensitive content is retained in a private space, only anonymized content is exposed to public LLM-powered agents, and original entities are restored after public-side reasoning is complete. In its 2025 formulation, GAMA is explicitly designed for tasks that must use high-performance remote LLMs without disclosing raw private data, and it augments anonymization with Domain-Rule-based Knowledge Enhancement (DRKE) and Disproof-based Logic Enhancement (DLE) to compensate for semantic degradation induced by masking (Yang et al., 12 Sep 2025). Within the broader multi-agent literature, this places GAMA in the line of work that treats privacy not as a peripheral wrapper but as part of the coordination architecture itself (Wang, 2024).

1. Definition and problem setting

GAMA addresses a practical problem in LLM-based multi-agent systems: high-performance LLMs are often hosted on remote servers in public spaces, yet many tasks contain privacy-sensitive information such as names, organizations, addresses, emails, and phone numbers. The central question is therefore how a multi-agent system can preserve privacy end-to-end while still performing effectively on real tasks. In the formulation of GAMA, the difficulty is not limited to data transmission. Privacy removal itself can cause semantic loss, naive anonymization can over-mask or under-mask because privacy is context-dependent, and multi-agent workflows amplify the challenge because privacy must be preserved across internal communication, task decomposition, and final answer restoration (Yang et al., 12 Sep 2025).

This framing distinguishes GAMA from narrower notions of anonymity. Earlier work on multi-agent privacy emphasizes that the privacy target may be an initial state, a reference signal, an objective function, a gradient, or even the existence of a state, and that the core risk arises from the information exchange required for coordination (Wang, 2024). GAMA, by contrast, is centered on privacy-sensitive task content in LLM-mediated workflows. Its concern is not merely whether communication occurs, but what semantic material is exposed to the public model during multi-agent reasoning.

A related clarification is terminological. The acronym “GAMA” is also used in a different arXiv context to denote a mature, spatially explicit agent-based modeling environment coupled with Unity for immersive simulations, where GAMA remains the scientific simulation engine and Unity provides the VR front-end (Drogoul et al., 11 Feb 2025). That usage is unrelated to General Anonymizing Multi-Agent System.

2. Core architecture and anonymizing mechanism

The high-level architecture divides the workspace into two isolated regions. The private space contains the original sensitive task content and performs local privacy-aware processing. The public space receives only anonymized text, uses remote LLM agents for reasoning and answering, and hosts the enhancement modules DRKE and DLE. The operational pipeline is: identify private entities in the original task, build a privacy box mapping entities to placeholders, anonymize the question before sending it to public agents, use public-space agents to reason over anonymized text, enhance knowledge and logic with DRKE and DLE, return the answer to private space, and restore original sensitive entities using the privacy box (Yang et al., 12 Sep 2025).

The privacy core is AMPP, the Anonymizing Mechanism for Privacy Preservation. AMPP includes Multi-View Privacy Identification (MVPI), a privacy box, an anonymizing agent, and a nominating agent for restoration. MVPI combines two views. The first is Privacy NER (PNER), a local named-entity-recognition-based view:

$$\boldsymbol{e}_{v_1}=\{e_1,e_2,\ldots,e_N\}=\mathcal{N}_{priv}(x).$$

The second is a Privacy-Identifying Agent (PIA), an LLM-based agent using broader social and contextual judgment:

$$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$

These are fused as

$$\boldsymbol{e}_{priv} = (\boldsymbol{e}_{v_1} \cap \boldsymbol{e}_{v_2}) \cup \mathcal{S}_{fus}((\boldsymbol{e}_{v_1} \cup \boldsymbol{e}_{v_2})- (\boldsymbol{e}_{v_2} \cap \boldsymbol{e}_{v_1})).$$

This fusion retains overlap between the two detectors and uses a fusion agent to adjudicate the remaining candidates.

Once privacy entities are identified, GAMA creates a privacy box, a bidirectional mapping between sensitive entities and placeholders. The mapping vocabulary is defined as

$\mathcal{V}=Vocab(\boldsymbol{e}_{priv}),$

with

$$\mathcal{V}=\{(e_1,p_1),(e_2,p_2),\ldots,(e_L,p_L)\},$$

where placeholders may include <name>, <location>, <organization>, <phone>, and <email>. The private question is transformed by

$$\boldsymbol{x}^{\prime}=Map(\boldsymbol{x}| \mathcal{V}),$$

and the public-space answer is restored by

$$\boldsymbol{y}^{\prime}=Remap(\boldsymbol{y}|\mathcal{V}).$$

The architectural implication is that public agents never operate on the raw sensitive entities themselves.

3. Knowledge recovery and logic refinement

A central feature of GAMA is that anonymization is not treated as sufficient on its own. The framework explicitly assumes that masking private entities can damage knowledge retrieval, domain inference, and logical reasoning. DRKE and DLE are therefore introduced as semantic recovery mechanisms in the public space, serving knowledge-heavy and logic-heavy tasks respectively (Yang et al., 12 Sep 2025).

DRKE, the Domain-Rule-based Knowledge Enhancement module, operates in two stages: domain analysis with auto-prompting, followed by domain rule construction with multi-rule inference. Domain analysis combines high-order domain reasoning from a Domain-Analyzing Agent (DAA) with elementary domain matching via TF-IDF:

$$\boldsymbol{R}_{ho}=W2V(DAA(\boldsymbol{x})|\boldsymbol{D}_{ref}),$$

$$\boldsymbol{R}_{elm}=TFIDE(\boldsymbol{x}|\boldsymbol{D}_{ref}),$$

$$\boldsymbol{D}_{tar}=\mathcal{T}_K (\alpha \boldsymbol{R}_{ho}+(1-\alpha)\boldsymbol{R}_{elm}).$$

The reference domain set includes categories such as Entertainment, Finance, History, Law, Sociology, Medicine, Politics, Science, and Technology. After selecting target domains, DRKE constructs domain rules of the form “IF $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$0 is Entertainment, THEN $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$1,” with analogous rules for other domains. The THEN-parts are Domain Expert Agents (DEAs), and a fusing agent merges their outputs. The stated role of this mechanism is to recover lost semantics, improve knowledge retrieval, reduce hallucinations, and produce a more reliable final answer.

DLE, the Disproof-based Logic Enhancement module, is designed for logic-heavy tasks. Its method is operational rather than statistical: assume an answer is true, search for contradictions, revise the answer when contradictions are found, and stop when no contradiction remains. In the paper’s description, an expert agent proposes an answer, an assistant agent checks for inconsistencies, contradictions are appended back into the question context, and the loop repeats until no new contradiction is detected. The role of DLE is to narrow the answer space, suppress hallucination, and improve logical consistency under anonymized inputs.

Taken together, DRKE and DLE make GAMA more than a placeholder-substitution pipeline. The public-space reasoning layer is explicitly modified to compensate for the information discarded by anonymization. A plausible implication is that GAMA’s design assumes semantic preservation must be engineered rather than expected to arise automatically from generic LLM prompting.

4. Empirical evaluation and reported performance

The empirical study evaluates GAMA on four datasets: two public benchmarks and two privacy-specific datasets. The public benchmarks are Trivia Creative Writing (TCW), a knowledge-intensive task with settings at $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$2 and $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$3 trivia questions and 100 instances for each setting, and Logic Grid Puzzle (LGP), a logic reasoning benchmark from BigBench with 200 instances. The privacy-specific datasets are Knowledge Privacy Preservation (KPP), with 100 instances and 500 total questions, and Logic Privacy Preservation (LPP), with 150 instances. The experimental stack uses GPT-4o in the public space with temperature $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$4 and top value $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$5, local Llama3-8B in the private space, a fine-tuned bert-large-NER model for NER, and BERT for similarity measurement (Yang et al., 12 Sep 2025).

On the public benchmarks, GAMA achieves 87.4 on TCW with $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$6, 88.3 on TCW with $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$7, and 75.5 on LGP. Relative to AutoAgents, the reported gains are +5.4 and +3.0 on the two TCW settings and +3.7 on LGP. Relative to Self-Refine, the reported gains are +13.5 and +11.4 on the two TCW settings and +15.5 on LGP. On the privacy-preserving benchmarks, GAMA achieves 54.8 on KPP and 82.0 on LPP, while still improving over the best compound baselines by +4.0 on KPP and +1.6 on LPP.

The paper also reports that MVPI outperforms NER-PRE and RPR on privacy identification, improving average privacy identification by 7.3 points on knowledge-related privacy tasks and 6.2 points on logic-related privacy tasks. Re-identification attack testing with ARX under prosecutor, journalist, and marketer attacker models yields success rates of 0.00%, 0.21%, and 0.01% respectively; the reported maximum remains below 0.21%. Privacy identification quality is measured with Precision, Recall, and $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$8; question fluency after anonymization is measured with BLEU; semantic consistency is measured with BERT-based similarity; and task score is computed by matching predicted answers to ground truth.

Ablation results clarify module roles. Removing AMPP raises task scores to 61.8 on KPP and 84.0 on LPP, which the paper interprets as evidence that anonymization itself induces semantic loss. Removing DRKE yields 57.3 on KPP and 82.5 on LPP, while removing DLE yields 53.2 on KPP and 76.9 on LPP. The interpretation given is that AMPP is essential for privacy, DRKE is important for knowledge recovery, and DLE is especially important for logic consistency. Reported average time costs are about 136–141s on TCW, 138s on LGP, 125s on KPP, and 156s on LPP, with around 20–21 GB GPU memory. Statistical testing uses a Friedman test with $$\boldsymbol{e}_{v_2}=\{e_1,e_2,\ldots,e_M\}=\mathcal{A}_{priv}(x).$$9 and $$\boldsymbol{e}_{priv} = (\boldsymbol{e}_{v_1} \cap \boldsymbol{e}_{v_2}) \cup \mathcal{S}_{fus}((\boldsymbol{e}_{v_1} \cup \boldsymbol{e}_{v_2})- (\boldsymbol{e}_{v_2} \cap \boldsymbol{e}_{v_1})).$$0, followed by Holm correction; the overall differences are reported as statistically significant, and GAMA is significantly better than Self-Refine, Std, CoT, and SPP, though not significantly better than AutoAgents in the post-hoc table.

5. Position within the anonymity and privacy literature

GAMA belongs to a broader research landscape in which privacy in multi-agent systems is treated as a structural property of coordination algorithms. The survey “Privacy in Multi-agent Systems” emphasizes that superior results are typically based on co-design of the privacy mechanism and coordination algorithm, and reviews representative mechanisms including partially homomorphic encryption, state decomposition, dynamics-based privacy, differential privacy, observability-based privacy, and server-based variants (Wang, 2024). GAMA is consistent with that co-design principle, but its mechanism is distinctive: it partitions computation into private and public spaces and combines anonymization with task-specific semantic enhancement rather than relying on a single cryptographic or noise-injection primitive.

Another relevant comparison is differential privacy in cooperative planning. In cooperative Markov games with reach-avoid objectives, privatizing symbolic state trajectories can severely degrade performance unless policies are explicitly synthesized to reduce total correlation among agents’ state-action processes (Chen et al., 2023). GAMA addresses a different substrate—LLM-based task solving rather than reach-avoid planning—but the shared design lesson is similar: privacy-preserving execution requires privacy-aware coordination rather than after-the-fact obfuscation.

The literature on anonymity in large populations provides a different notion of abstraction. In many-agent I-POMDPs, “anonymity” may mean that rewards and transitions depend on counts of actions or frames rather than on which agent acted, with frame-action hypergraphs providing a compact structured representation (Sonu et al., 2015). That is conceptually separate from GAMA’s content anonymization, but it illustrates that anonymity in multi-agent systems has long referred to symmetry, aggregation, and identity-insensitive reasoning, not only to masking text spans.

TrustMAS offers a closer communication-level precursor. It provides anonymous communication for all agents through random-walk forwarding, combines anonymity with trust, and allows StegAgents to exchange routing tables covertly as a distributed steganographic router (0808.4060). TrustMAS can reasonably be seen as an early concrete realization or precursor of a GAMA-like idea, but its focus is anonymous communication and steganographic routing rather than LLM-mediated reasoning over privacy-sensitive task content.

Finally, robustness-oriented multi-agent LLM work such as credibility-scored aggregation addresses yet another axis. A credibility-scoring framework can down-weight adversarial or low-performing agents over time and improve resilience even in adversary-majority settings, but it does not itself provide anonymization or privacy guarantees (Ebrahimi et al., 30 May 2025). This suggests that privacy-preserving GAMA-style architectures and adversary-resistant trust-weighted aggregation are complementary rather than interchangeable.

6. Scope, limitations, and common misconceptions

The explicit limitations of GAMA are twofold. First, privacy standards are human-defined: the framework relies on privacy concepts derived from human social norms and regulations and cannot autonomously invent new privacy categories. Second, severe semantic loss can still break tasks: if anonymization removes too much meaning, successful processing may become infeasible even with DRKE and DLE (Yang et al., 12 Sep 2025).

These limitations clarify several common misconceptions. GAMA is not equivalent to simple entity replacement. Its core system includes MVPI for privacy identification, a privacy box for reversible mapping, DRKE for domain-aware knowledge recovery, and DLE for contradiction-driven logic refinement. Nor is improved task score in an ablation without AMPP evidence that privacy is unnecessary; the reported increase after removing AMPP is explicitly tied to weaker privacy protection. A plausible implication is that GAMA formalizes privacy preservation as an optimization under unavoidable semantic loss rather than as a cost-free transformation.

It is also important not to conflate the different senses of anonymity present in the multi-agent literature. TrustMAS focuses on anonymous communication channels and covert routing (0808.4060); differential-privacy planning privatizes trajectories or coordination variables (Chen et al., 2023); large-population I-POMDP work exploits action and frame anonymity in the decision model itself (Sonu et al., 2015); and the privacy survey stresses that targets may include states, references, gradients, or objectives (Wang, 2024). In the sense used by General Anonymizing Multi-Agent System, privacy protection is centered on preventing raw sensitive task content from entering the public LLM workspace while still allowing the public agents to reason effectively over anonymized inputs.

In that form, GAMA is best understood as a specialized but technically explicit architecture for privacy-preserving LLM-based multi-agent computation: it separates private and public execution contexts, enforces reversible anonymization, and attempts to repair the semantic damage of masking through domain rules and disproof-based reasoning. Its reported results indicate that this combination can preserve substantial task performance while keeping re-identification success extremely low, but the framework remains conditioned by the quality of privacy identification, the recoverability of masked semantics, and the computational cost of multi-agent orchestration.