Collaborative LLM Agents Turn Multimodal Forensic Data Into Fraud Evidence

Health insurance fraud, particularly prescription drug trafficking, has become increasingly difficult to prosecute because it depends heavily on multimodal evidence extracted from suspects’ devices. Investigators must sift through images, voice messages and behavioral event logs scattered across multiple devices, yet existing forensic procedures remain largely text-centric and fragmented. They lack semantic enrichment and cross-source integration, which limits analytic efficiency and leaves gaps in evidential completeness. A new processing service named SAGE, powered by collaborative large language model agents, addresses these limitations by turning raw multimodal forensic data into structured, time-ordered representations that directly support downstream investigative tasks such as suspect profiling and relational analysis.

SAGE adopts a master–worker architecture in which worker agents perform modality-specific tasks. These tasks include classification, transcription and semantic extraction applied to images, voice messages and behavioral events.

A second core component, the Unique Identifier Network (UIDN), tackles the problem of fragmented identities across devices and external sources. Through this network, the service incrementally aligns and fuses entities drawn from multiple devices and from external data such as financial transactions and logistics records. The service outputs structured, time-ordered representations that directly support downstream tasks such as suspects' profiling and relational analysis.

Evaluation was conducted on two real-world health insurance fraud datasets, providing a test of the service against genuine investigative material rather than synthetic benchmarks. Across these datasets, SAGE processed over 1.34 million forensic records and identified 11,200 pieces of fraud evidence. The authors report that the evaluation on two real-world health insurance fraud datasets and the deployment in a practical project demonstrated outstanding performance and operational scalability.

Beyond the offline evaluation, SAGE has been deployed in a practical project, moving the service from research prototype to operational use. The authors state that the deployment in a practical project, where over 1.34 million forensic records revealed 11,200 pieces of fraud evidence, demonstrated operational scalability.

The source code and an illustrative sample dataset have been made publicly available on GitHub, allowing other research groups and forensic practitioners to examine, reproduce and extend the approach.

By performing classification, transcription and semantic extraction through collaborative LLM agents, and by aligning and fusing entities across devices and external sources, SAGE processes multimodal forensic data that existing text-centric and fragmented procedures handle poorly.

Subject of Research: A collaborative large language model agent service for processing multimodal forensic data in health insurance fraud investigations

Article Title: A Processing Service Through Collaborative LLM Agents on Multimodal Forensic Data

Article References: Ding, W., He, H., Tian, H., & Guo, J. (2026). A Processing Service Through Collaborative LLM Agents on Multimodal Forensic Data. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02540-6

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02540-6

Keywords: large language models, digital forensics, health insurance fraud, prescription drug trafficking, multimodal data, agent architecture, entity resolution, data fusion, suspect profiling, relational analysis, Processing, Service