<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="wang-etal-2026-facts">
    <titleInfo>
        <title>Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Yian</namePart>
        <namePart type="family">Wang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Agam</namePart>
        <namePart type="family">Goyal</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Eshwar</namePart>
        <namePart type="family">Chandrasekharan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Hari</namePart>
        <namePart type="family">Sundaram</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used—a failure mode we call summary collapse. On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge (ąppa = 0.74), where σ_b = 1 means every boundary marker survives verbatim and σ_b = 0 means all are lost. Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson r near zero): uncompressed free-text handoffs preserve boundaries at σ_b \approx 0.80, whereas a 25-word budget drops σ_b to \approx0.57 while operational-fact survival stays near ceiling. Controlled downstream tests reveal that protection depends on boundary explicitness: vague languages leak in 73% of GPT and 50% of DeepSeek cases, while explicit constraints reduce leakage to under 15% across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.</abstract>
    <identifier type="citekey">wang-etal-2026-facts</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.422/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>8877</start>
            <end>8899</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs
%A Wang, Yian
%A Goyal, Agam
%A Chandrasekharan, Eshwar
%A Sundaram, Hari
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F wang-etal-2026-facts
%X Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used—a failure mode we call summary collapse. On a controlled multi-agent coordination testbed we measure marker survival with a human-validated judge (ąppa = 0.74), where σ_b = 1 means every boundary marker survives verbatim and σ_b = 0 means all are lost. Boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson r near zero): uncompressed free-text handoffs preserve boundaries at σ_b \approx 0.80, whereas a 25-word budget drops σ_b to \approx0.57 while operational-fact survival stays near ceiling. Controlled downstream tests reveal that protection depends on boundary explicitness: vague languages leak in 73% of GPT and 50% of DeepSeek cases, while explicit constraints reduce leakage to under 15% across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology as direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction only partially address the problem, while a gold-derived audience allowlist nearly eliminates leakage across models, showing that correctly identifying audience boundaries is the key factor.
%U https://aclanthology.org/2026.findings-emnlp.422/
%P 8877-8899

Markdown (Informal)

[Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs](https://aclanthology.org/2026.findings-emnlp.422/) (Wang et al., Findings 2026)

• Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs (Wang et al., Findings 2026)

ACL

• Yian Wang, Agam Goyal, Eshwar Chandrasekharan, and Hari Sundaram. 2026. Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 8877–8899, Budapest, Hungary. Association for Computational Linguistics.