LLM‑based multi‑agent systems require topology‑guided safeguards that locate risky agents on the communication graph and intervene on the topology. Existing approaches assume a single operator can pool all judge‑labeled episode traces, which breaks down across organizations where prompts, tool outputs, and proprietary workflows are private and no single silo sees the full attack distribution.
We cast this safeguarding problem as graph federated learning and instantiate FGLGuard. Each operator locally trains an edge‑featured graph attention detector on its own judge‑labeled episode graphs and shares only model updates, preserving data confidentiality.
Key techniques include a proximal local objective to handle non‑IID clients, domain‑balanced aggregation, over‑refusal‑constrained threshold calibration, corroborated upstream scoring, and a guarded rewrite for blocked answers.
On the AgentSafetyBench, R‑Judge, and AgentDojo benchmarks, federated FGLGuard exceeds the in‑domain centralized ceiling without any data pooling, outperforming unsupervised anomaly guards and local‑only training. A guard federated across four different‑domain operators reaches within 0.03 AUROC of multi‑domain centralization, while any single‑domain guard collapses on the others. Live deployment cuts AgentDojo’s ground‑truth attack‑success rate by 43% with near‑unguarded utility, zero API cost, and negligible capability loss.
The results demonstrate that federation is indispensable: off‑the‑shelf transfer collapses under distribution shift (AUROC improves only from 0.51 to 0.70 after in‑domain retraining), so a deployable guard must adapt on each site’s private traces.
Review: FGLGuard provides a practical pathway for cross‑organization safety collaboration in LLM‑based MAS, showing that privacy‑preserving graph federated learning can deliver robust, high‑performing safeguards without sacrificing data confidentiality.