Pith. sign in

REVIEW 3 major objections 5 minor 2 cited by

Security of Internet of Agents: Attacks and Countermeasures

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that the Internet of Agents has a security and privacy threat landscape distinct from both traditional networks and isolated LLM agents, and organizes it into four categories with defenses and open challenges.

desk verdict A useful map of a young field, but the 'distinct vulnerabilities' claim overreaches: the taxonomy repackages known single-agent and CPS threats, and at least two table entries cite papers that do not support the IoA framing. read the letter →

arxiv 2505.08807 v1 pith:Q5QYV4QU submitted 2025-05-12 cs.CR cs.AI

Yuntao Wang , Yanghe Pan , Shaolong Guo , Zhou Su This is my paper · ORCID
classification cs.CRcs.AI
keywords InternetofAgentsAIagentsecurityLLMthreatsidentityauthenticationcross-agenttrustembodiedprivacyleakagecommunicationprotocols
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to establish that the Internet of Agents (IoA)—an emerging web in which AI agents discover, negotiate with, and coordinate across each other—has a security and privacy threat landscape of its own, distinct from both conventional networks and single-agent LLM systems. It organizes that landscape into four families: identity authentication threats, cross-agent trust issues, embodied security, and privacy risks. For each family it catalogs concrete attacks, including voice forgery from a face image, hallucination cascades across chained agents, sensor spoofing of drones, and extraction of private retrieval-augmented-generation data, and it reviews defensive measures. If the taxonomy is right, it gives system builders a common vocabulary for what can go wrong in agent networks and where defenses should sit.

What carries the argument

The organizing machinery is the four-part threat taxonomy itself, anchored in an account of what makes IoA different: large-model foundations, decentralization, task-driven cooperation, semantic-aware interaction, and cyber-physical coupling. The taxonomy is populated with named attack families, such as hallucination cascade, contextual backdoor, and RAG-Thief, and paired with corresponding defense families, including access control, decentralized identifiers with verifiable credentials, RAG grounding, multi-agent audit and debate, topology isolation, sensor redundancy, world-model simulation, multimodal consistency validation, privacy pre-assessment, and output intervention. These pairings are what let the survey claim both that the threat space is structured and that mitigations can be mapped onto it.

What would settle it

A concrete disconfirmation would be a systematic audit showing that every attack in the taxonomy succeeds with equal or greater ease against a single LLM agent or an ordinary IoT device with no agent-to-agent coordination involved; that would collapse the claimed IoA-specific threat landscape into a relabeling of existing categories.

Watch

Extended reading notes

Core claim

The paper's central claim is that the IoA introduces material new attack surfaces because agents are autonomous, decentralized, task-driven, communicate through semantically rich natural-language protocols, and often control physical systems. The resulting taxonomy has four parts. Identity authentication threats include identity forgery, impersonation, Sybil attacks, privilege escalation, and intent deception. Cross-agent trust issues include hallucination cascades, knowledge poisoning, adversarial inputs, jailbreaks, prompt injection, free-riding, and collusion. Embodied security includes sensor attacks, contextual backdoors, and cross-domain safety misalignment, where an agent refuses a harmful request in words but still emits executable dangerous action code. Privacy threats include contextual inference, RAG-based data extraction, and memorization of personally identifiable information. The paper also argues that defenses must be dynamically adaptive rather than static, and should span identity, communication, inference, and actuation layers.

Load-bearing premise

The load-bearing premise is that the Internet of Agents is a genuinely new security context, so that attacks and defenses developed for single LLM agents and ordinary cyber-physical systems genuinely apply and combine there.

Editorial extensions

If this is right

  • IoA deployments will need identity management built around tamper-resistant decentralized identifiers and verifiable credentials, plus context-aware access control that adjusts as agents change roles.
  • Chained agent workflows should assume that one agent's hallucination or poisoned output can amplify downstream, making RAG grounding, multi-agent auditing, and topology-level isolation standard practice.
  • Embodied agents need defense in depth spanning hardware shielding, redundant sensors, world-model simulation, and validation that language and action outputs agree.
  • Privacy protections should combine pre-deployment leakage assessment with runtime filtering and redaction of sensitive outputs, since inference and memorization can leak data that was never directly disclosed.
  • Static security rules will not be enough; the paper's lessons point to adaptive, semantically aware, real-time defenses across the whole agent lifecycle.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next step beyond the survey would be to benchmark each listed attack in paired single-agent versus multi-agent settings, isolating which threats are genuinely IoA-specific rather than inherited from LLM agents or general networked systems.
  • The 'threat cascade' and 'full-process poisoning' challenges could be formalized as propagation problems on agent graphs, making it possible to measure how misinformation amplifies with chain length and network connectivity.
  • Protocol-level consent and privacy controls, which the paper lists as a future direction, may be a more scalable privacy defense than per-output filtering because they would stop leakage before it occurs.
  • The taxonomy suggests that security review of agent communication protocols should become part of protocol standardization itself, since several named attacks are enabled by protocol features such as tool-description parsing and agent cards.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper is a survey of security and privacy issues in the Internet of Agents (IoA). It proposes a four-part taxonomy of threats—identity authentication, cross-agent trust, embodied security, and privacy—illustrates each category with recent attack and defense examples, and concludes with open challenges and future research directions. The paper positions itself against prior LLM-agent security surveys in Table I and summarizes its taxonomy in Fig. 1, with supporting detail in Sections III–VI and a consolidated threat/defense table in Table III.

Significance. If its central claim is accepted, the survey would offer a useful map of a rapidly emerging field and a starting point for researchers working on IoA-specific defenses. The paper's strengths are its breadth of recent references, concrete attack examples (e.g., Foice, Breaking Agents, RAG-Thief, and MEMS sensor attacks), clear graphical summaries, and a helpful comparison with prior surveys. It contains no derivations or empirical evaluations, so its value is organizational and agenda-setting rather than technical. However, that value depends on the claim that the surveyed threats are genuinely IoA-specific; as it stands, several taxonomy entries are supported only by work on general RAG, federated learning, or cyber-physical systems, which leaves the central contribution under-substantiated.

major comments (3)
  1. [Section IV, Table III] The 'Free-Riding Attack' entry is not supported by its cited reference. Section IV describes a selfish agent withholding effort in cooperative IoA tasks, but Table III maps this threat to 'Coalition game, Shapley value' and cites [59], Wang et al., 'Social-aware clustered federated learning with customized privacy preservation,' which addresses incentive design in federated learning and does not describe free-riding attacks or Shapley-value defenses in an agent-to-agent LLM/IoA setting. To sustain this taxonomy cell, the paper needs either a directly relevant IoA reference or an explicit argument for why the federated-learning result transfers.
  2. [Section IV, 'Knowledge Poisoning' bullet] The claim that PoisonedRAG [30] targets 'external knowledge bases in IoA' misstates the original work. Zou et al. present PoisonedRAG as a knowledge-poisoning attack on retrieval-augmented generation systems generally, and the survey provides no agent-to-agent poisoning scenario or modified threat model. Table III repeats this mapping. Since knowledge poisoning is one of the central cross-agent trust threats, the IoA-specific instantiation needs to be demonstrated rather than asserted.
  3. [Section II-C, Fig. 1] The abstract's claim of 'distinct vulnerabilities compared to traditional networks' and the taxonomic boundaries in Fig. 1 are not backed by a stated methodology. There is no description of how references were selected, how threats were classified as IoA-specific, or how transfer from single-agent LLM or cyber-physical systems was justified. As a result, several entries read as relabelings: voice forgery [6] and the sensor attacks [43]–[47] are general voice/CPS attacks, and their amplification in IoA is asserted in prose rather than shown. A short methodology or inclusion-criteria paragraph would make the 'comprehensive' claim checkable and would distinguish genuine IoA-specific threats from inherited ones.
minor comments (5)
  1. [Section I] The phrase 'Zhang et al. et al. [17]' contains a duplicated 'et al.' and should read 'Zhang et al. [17]'.
  2. [Section III, 'Impersonation Attacks'] The text says 'as shown in Fig. 2(b),' but Fig. 2(b) is labeled 'Sybil Attack'; the impersonation attack is not separately depicted, so the figure callout should be corrected or the figure extended.
  3. [Section V, 'Defenses'] The phrase 'through through physical defense' contains a duplicated word and should read 'through physical defense.'
  4. [Section VI, 'Defenses'] The sentence 'Existing defenses of IoA privacy threats involves two complementary strategies' has a subject-verb agreement error; 'involves' should be 'involve.'
  5. [Section VII] The lesson-learned bullet says 'access control mechanisms is essential' and 'provides tamper-resistant identity management'; both should agree in number with their subjects.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the survey is an organizational taxonomy, not a derivation, and its self-citations are background or non-load-bearing.

full rationale

This manuscript is a survey and taxonomy paper. It derives no quantitative result, fits no parameters, and makes no formal prediction, so the core circularity patterns (self-definitional equations, fitted-input-as-prediction, imported uniqueness theorems, ansatz-smuggling) do not apply. The claimed contribution is the four-part organization of IoA security and privacy threats (identity authentication, cross-agent trust, embodied security, privacy) together with a mapping to defenses; this is an assertion of structure rather than a consequence of the paper's own inputs. The authors' prior works appear in two places: [1] is cited in the introduction as background on large-model agents, and [59] is listed in Table III as a Shapley-value/coalition-game defense suggestion for free-riding. Neither citation carries the paper's central claim. The taxonomy is populated largely by external references (e.g., [7], [8], [9], [11], [30], [43]-[47]), and even if [59] is a poor topical match for IoA free-riding, that is an evidence-relevance weakness rather than a circular dependency. No step in the paper reduces by construction to its own definitions or to an author-imposed uniqueness claim. The lack of a stated selection methodology may affect the supportability of the word "comprehensive", but that is a methodological or correctness concern, not circularity. The correct circularity verdict is therefore clean: score 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The survey's central claim rests on the premise that the IoA will be a real and distinct infrastructure and that existing single-agent security findings carry over. These assumptions are reasonable but not established in this paper.

assumptions (3)
  • domain assumption AI agents will be widely deployed and will need to interconnect, forming an IoA.
    Introduced in Section I via Gartner projection and refs [4], [5]; the survey's premise depends on this.
  • domain assumption The four protocols (MCP, A2A, ANP, Agora) represent the core communication standards of IoA.
    Section II-B lists these as representative; if these protocols do not become standard, threat analyses tied to them become less relevant.
  • domain assumption Attacks on single-agent LLM systems and on cyber-physical systems are directly applicable to the IoA context.
    Sections III-VI map many single-agent attacks (e.g., jailbreak, prompt injection) to IoA without new experiments; this transfer assumption is not explicitly justified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Security of Internet of Agents: Attacks and Countermeasures." pith.science (2026). https://pith.science/paper/Q5QYV4QU

@misc{pith2026250508807,
  author       = {Pith},
  title        = {Pith review of: Security of Internet of Agents: Attacks and Countermeasures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q5QYV4QU}},
  note         = {Machine review of arXiv:2505.08807}
}
read the original abstract

With the rise of large language and vision-language models, AI agents have evolved into autonomous, interactive systems capable of perception, reasoning, and decision-making. As they proliferate across virtual and physical domains, the Internet of Agents (IoA) has emerged as a key infrastructure for enabling scalable and secure coordination among heterogeneous agents. This survey offers a comprehensive examination of the security and privacy landscape in IoA systems. We begin by outlining the IoA architecture and its distinct vulnerabilities compared to traditional networks, focusing on four critical aspects: identity authentication threats, cross-agent trust issues, embodied security, and privacy risks. We then review existing and emerging defense mechanisms and highlight persistent challenges. Finally, we identify open research directions to advance the development of resilient and privacy-preserving IoA ecosystems.

Figures

Figures reproduced from arXiv: 2505.08807 by the authors.

Figure 1
Figure 1. The taxonomy of security and privacy threats in IoA. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Illustration of agent identity authentication threats in IoA: (a) identity forgery, (b) Sybil attack, and (c) intent deception. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Illustration of cross-agent trust issues within IoA: (a) hallucination cascade, (b) knowledge poisoning, and (c) jailbreak. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Illustration of security threats to embodied agents in IoA: (a) [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Illustration of privacy threats in IoA: (a) RAG privacy leakage, and [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

    cs.CR 2026-08 conditional novelty 5.0 of 10

    A PRISMA-based survey of 85 papers shows agentic LLM security research is attack-heavy and perception-focused, leaving action-layer and code-execution risks understudied.

  2. SoK: Security and Privacy of AI Agents for Blockchain

    cs.CR 2025-09 conditional novelty 5.0 of 10

    A systematization of knowledge that proposes a taxonomy and reference architecture for blockchain AI agents, and catalogs security and privacy threats.

Reference graph

Works this paper leans on

63 extracted references · 46 canonical work pages · cited by 2 Pith papers

  1. [59]

    Extracting training data from large language models,

    N. Carlini, F. Tram `er, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. B. Brown, D. Song, ´U. Erlingsson, A. Oprea, and C. Raffel, “Extracting training data from large language models,” in Proc. USENIX Security , pp. 2633–2650, 2021

    work page 2021

  2. [30]

    MCP security notification: Tool poisoning attacks

    I. Labs, “MCP security notification: Tool poisoning attacks.” https: //invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks,

    work page

  3. [6]

    Can i hear your face? pervasive attack on voice authentication systems with a single face image,

    N. Jiang, B. Sun, T. Sim, and J. Han, “Can i hear your face? pervasive attack on voice authentication systems with a single face image,” in Proc. USENIX Security , pp. 1045–1062, 2024

    work page 2024

  4. [43]

    GuardAgent: Safeguard LLM agent by a guard agent via knowledge-enabled reasoning,

    Z. Xiang, L. Zheng, Y . Li, J. Hong, Q. Li, H. Xie, J. Zhang, Z. Xiong, C. Xie, C. Yang, et al., “GuardAgent: Safeguard LLM agent by a guard agent via knowledge-enabled reasoning,” arXiv preprint arXiv:2406.09187, 2024

    arXiv 2024

  5. [47]

    Rocking drones with intentional sound noise on gyroscopic sensors,

    Y . Son, H. Shin, D. Kim, Y . Park, J. Noh, K. Choi, J. Choi, and Y . Kim, “Rocking drones with intentional sound noise on gyroscopic sensors,” in Proc. USENIX Security , pp. 881–896, 2015

    work page 2015

  6. [1]

    Large model agents: State-of-the-art, cooperation paradigms, security and privacy, and future trends,

    Y . Wang, Y . Pan, Q. Zhao, Y . Deng, Z. Su, L. Du, and T. H. Luan, “Large model agents: State-of-the-art, cooperation paradigms, security and privacy, and future trends,” arXiv preprint arXiv:2409.14457, pp. 1– 40, 2024

    arXiv 2024

  7. [2]

    See and think: Embodied agent in virtual environment,

    Z. Zhao, W. Chai, X. Wang, B. Li, S. Hao, S. Cao, T. Ye, and G. Wang, “See and think: Embodied agent in virtual environment,” in European Conference on Computer Vision , pp. 187–204, 2024

    work page 2024

  8. [3]

    Intelligent agents in AI

    Gartner, “Intelligent agents in AI.” https://www.gartner.com/en/articles/ intelligent-agent-in-ai, 2023. Accessed on 2025-01-19

    work page 2023

Show all 63 references
  1. [4]

    Internet of agents: Weaving a web of heterogeneous agents for collaborative intelligence,

    W. Chen, Z. You, R. Li, yitong guan, C. Qian, C. Zhao, C. Yang, R. Xie, Z. Liu, and M. Sun, “Internet of agents: Weaving a web of heterogeneous agents for collaborative intelligence,” in Proc. ICLR, pp. 1–32, 2025

    2025

  2. [5]

    DAWN: Designing distributed agents in a worldwide network,

    Z. Aminiranjbar, J. Tang, Q. Wang, S. Pant, and M. Viswanathan, “DAWN: Designing distributed agents in a worldwide network,” Au- thorea Preprints, pp. 1–11, 2024

    2024

  3. [7]

    CDA: Covert deception attacks in multi-agent resource scheduling,

    W. Hao, J. Liu, W. Li, and L. Chen, “CDA: Covert deception attacks in multi-agent resource scheduling,” IEEE Robotics and Automation Letters, vol. 9, no. 11, pp. 9215–9222, 2024

    2024

  4. [8]

    Secret collusion among ai agents: Multi-agent deception via steganography,

    S. R. Motwani, M. Baranchuk, M. Strohmeier, V . Bolina, P. H. Torr, L. Hammond, and C. S. de Witt, “Secret collusion among ai agents: Multi-agent deception via steganography,” in Proc. NeurIPS , vol. 37, pp. 73439–73486, 2024

    2024

  5. [9]

    Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,

    R. M. S. Khan, Z. Tan, S. Yun, C. Flemming, and T. Chen, “Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,” arXiv preprint arXiv:2504.00218 , 2025

    2025

  6. [10]

    Can we trust embodied agents? exploring backdoor attacks against embodied LLM-based decision-making systems,

    R. Jiao, S. Xie, J. Yue, T. SATO, L. Wang, Y . Wang, Q. A. Chen, and Q. Zhu, “Can we trust embodied agents? exploring backdoor attacks against embodied LLM-based decision-making systems,” in Proc. ICLR, pp. 1–31, 2025

    2025

  7. [11]

    How language model hallucinations can snowball,

    M. Zhang, O. Press, W. Merrill, A. Liu, and N. A. Smith, “How language model hallucinations can snowball,” in Proc. ICML, pp. 1–15, 2024

    2024

  8. [12]

    Security and privacy challenges of large language models: A survey,

    B. C. Das, M. H. Amini, and Y . Wu, “Security and privacy challenges of large language models: A survey,” ACM Computing Surveys, vol. 57, no. 6, 2025

    2025

  9. [13]

    The emerged security and privacy of llm agent: A survey with case studies,

    F. He, T. Zhu, D. Ye, B. Liu, W. Zhou, and P. S. Yu, “The emerged security and privacy of llm agent: A survey with case studies,” arXiv preprint arXiv:2407.19354, 2024

    2024

  10. [14]

    Unique security and privacy threats of large language model: A comprehensive survey,

    S. Wang, T. Zhu, B. Liu, M. Ding, X. Guo, D. Ye, W. Zhou, and P. S. Yu, “Unique security and privacy threats of large language model: A comprehensive survey,” arXiv preprint arXiv:2406.07973 , 2024

    2024

  11. [15]

    Navigating the risks: A survey of security, privacy, and ethics threats in llm-based agents,

    Y . Gan, Y . Yang, Z. Ma, P. He, R. Zeng, Y . Wang, Q. Li, C. Zhou, S. Li, T. Wang, et al., “Navigating the risks: A survey of security, privacy, and ethics threats in llm-based agents,” arXiv preprint arXiv:2411.09523 , 2024. 11

    2024 arXiv

  12. [16]

    Personal LLM agents: Insights and survey about the capability, efficiency and security,

    Y . Li, H. Wen, W. Wang, X. Li, Y . Yuan, G. Liu, J. Liu, W. Xu, X. Wang, Y . Sun, et al. , “Personal LLM agents: Insights and survey about the capability, efficiency and security,” arXiv preprint arXiv:2401.05459 , 2024

    2024 arXiv

  13. [17]

    Physical safety and cyber security analysis of multi-agent systems: A survey of recent advances,

    D. Zhang, G. Feng, Y . Shi, and D. Srinivasan, “Physical safety and cyber security analysis of multi-agent systems: A survey of recent advances,” IEEE/CAA Journal of Automatica Sinica , vol. 8, no. 2, pp. 319–333, 2021

    2021

  14. [18]

    AI agents under threat: A survey of key security challenges and future pathways,

    Z. Deng, Y . Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y . Xiang, “AI agents under threat: A survey of key security challenges and future pathways,” ACM Computing Surveys , vol. 57, no. 7, pp. 1–36, 2025

    2025

  15. [19]

    A comprehensive survey in LLM (- agent) full stack safety: Data, training and deployment,

    K. Wang, G. Zhang, Z. Zhou, J. Wu, M. Yu, S. Zhao, C. Yin, J. Fu, Y . Yan, H. Luo, et al. , “A comprehensive survey in LLM (- agent) full stack safety: Data, training and deployment,” arXiv preprint arXiv:2504.15585, 2025

    2025 arXiv

  16. [20]

    From persona to personalization: A survey on role-playing language agents,

    J. Chen, X. Wang, R. Xu, S. Yuan, Y . Zhang, W. Shi, J. Xie, S. Li, R. Yang, T. Zhu, et al. , “From persona to personalization: A survey on role-playing language agents,” Transactions on Machine Learning Research, pp. 1–50, 2024

    2024

  17. [21]

    Model context protocol (MCP)

    Anthropic, “Model context protocol (MCP).” https://www.anthropic.co m/news/model-context-protocol, 2024. Accessed: Jan. 20, 2025

    2024

  18. [22]

    Agent to agent protocol (A2A)

    Google, “Agent to agent protocol (A2A).” https://google.github.io/A2A,

  19. [23]

    Agent network protocol (ANP)

    “Agent network protocol (ANP).” https://agentnetworkprotocol.com/en/,

  20. [24]

    Agora protocol

    E. A. University of Oxford, “Agora protocol.” https://agoraprotocol.org,

  21. [25]

    Model context protocol (MCP): Landscape, security threats, and future research directions,

    X. Hou, Y . Zhao, S. Wang, and H. Wang, “Model context protocol (MCP): Landscape, security threats, and future research directions,” arXiv preprint arXiv:2503.23278 , 2025

    2025 arXiv

  22. [26]

    Whole-process privacy-preserving and sybil-resilient consensus for multiagent net- works,

    Y . Wu, C. Ying, N. Zheng, W.-A. Zhang, and S. Zhu, “Whole-process privacy-preserving and sybil-resilient consensus for multiagent net- works,” IEEE Transactions on Neural Networks and Learning Systems , pp. 1–13, 2024

    2024

  23. [27]

    26, 2025

    Accessed: Apr. 26, 2025

    2025

  24. [28]

    A survey on access control in the age of Internet of things,

    J. Qiu, Z. Tian, C. Du, Q. Zuo, S. Su, and B. Fang, “A survey on access control in the age of Internet of things,” IEEE Internet of Things Journal, vol. 7, no. 6, pp. 4682–4696, 2020

    2020

  25. [29]

    A survey on decentralized identifiers and verifi- able credentials,

    C. Mazzocca, A. Acar, S. Uluagac, R. Montanari, P. Bellavista, and M. Conti, “A survey on decentralized identifiers and verifi- able credentials,” IEEE Communications Surveys & Tutorials , 2025. doi:10.1109/COMST.2025.3543197

    2025

  26. [31]

    Accessed: 2025-04-25

    2025

  27. [32]

    Breaking agents: Compromising autonomous LLM agents through malfunction amplification,

    B. Zhang, Y . Tan, Y . Shen, A. Salem, M. Backes, S. Zannettou, and Y . Zhang, “Breaking agents: Compromising autonomous LLM agents through malfunction amplification,” arXiv preprint arXiv:2407.20859 , pp. 1–15, 2024

    2024 arXiv

  28. [33]

    Audit-LLM: Multi-agent collaboration for log-based insider threat detection,

    C. Song, L. Ma, J. Zheng, J. Liao, H. Kuang, and L. Yang, “Audit-LLM: Multi-agent collaboration for log-based insider threat detection,” arXiv preprint arXiv:2408.08902, 2024

    2024 arXiv

  29. [34]

    PoisonedRAG: Knowledge poisoning attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge poisoning attacks to retrieval-augmented generation of large language models,” in Proc. USENIX Security , pp. 1–30, 2024

    2024

  30. [35]

    Pandora: Detailed LLM jailbreaking via collaborated phishing agents with decomposed reasoning,

    Z. Chen, Z. Zhao, W. Qu, Z. Wen, Z. Han, Z. Zhu, J. Zhang, and H. Yao, “Pandora: Detailed LLM jailbreaking via collaborated phishing agents with decomposed reasoning,” in ICLR Workshop on Secure and Trustworthy Large Language Models , pp. 1–15, 2024

    2024

  31. [36]

    Retrieval-augmented generation for knowledge-intensive NLP tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K¨uttler, M. Lewis, W.-t. Yih, T. Rockt¨aschel, S. Riedel, and D. Kiela, “Retrieval-augmented generation for knowledge-intensive NLP tasks,” in Proc. NeurIPS, vol. 33, pp. 9459–9474, 2020

    2020

  32. [37]

    Good parenting is all you need–multi-agentic LLM hallucination mitigation,

    T. Kwartler, M. Berman, and A. Aqrawi, “Good parenting is all you need–multi-agentic LLM hallucination mitigation,” arXiv preprint arXiv:2410.14262, 2024

    2024 arXiv

  33. [38]

    GPTSwarm: Language agents as optimizable graphs,

    M. Zhuge, W. Wang, L. Kirsch, F. Faccio, D. Khizbullin, and J. Schmid- huber, “GPTSwarm: Language agents as optimizable graphs,” in Proc. ICML, pp. 1–25, 2024

    2024

  34. [39]

    Exploring LLM- based multi-agent situation awareness for zero-trust space-air-ground integrated network,

    X. Cao, G. Nan, H. Guo, H. Mu, L. Wang, Y . Lin, Q. Zhou, J. Li, B. Qin, Q. Cui, X. Tao, H. Fang, H. Du, and T. Q. Quek, “Exploring LLM- based multi-agent situation awareness for zero-trust space-air-ground integrated network,” IEEE Journal on Selected Areas in Communica- tion...

    2025

  35. [40]

    Improving factuality and reasoning in language models through multiagent debate,

    Y . Du, S. Li, A. Torralba, J. B. Tenenbaum, and I. Mordatch, “Improving factuality and reasoning in language models through multiagent debate,” in Proc. ICML, pp. 11733–11763, 2023

    2023

  36. [41]

    Certifying LLM safety against adversarial prompting,

    A. Kumar, C. Agarwal, S. Srinivas, S. Feizi, and H. Lakkaraju, “Certifying LLM safety against adversarial prompting,” arXiv preprint arXiv:2309.02705, pp. 1–32, 2023

    2023 arXiv

  37. [42]

    RARR: researching and revising what language models say, using language models,

    L. Gao, Z. Dai, P. Pasupat, A. Chen, A. T. Chaganty, Y . Fan, V . Y . Zhao, N. Lao, H. Lee, D. Juan, and K. Guu, “RARR: researching and revising what language models say, using language models,” in Proc. ACL, pp. 16477–16508, 2023

    2023

  38. [44]

    ESP spoofing: Covert acoustic attack on mems gyroscopes in vehicles,

    Z. Hong, X. Li, Z. Wen, L. Zhou, H. Chen, and J. Su, “ESP spoofing: Covert acoustic attack on mems gyroscopes in vehicles,” IEEE Trans- actions on Information Forensics and Security , vol. 17, pp. 3734–3747, 2022

    2022

  39. [45]

    MetaWave: Attacking mmwave sensing with meta-material-enhanced tags,

    X. Chen, Z. Li, B. Chen, Y . Zhu, C. X. Lu, Z. Peng, F. Lin, W. Xu, K. Ren, and C. Qiao, “MetaWave: Attacking mmwave sensing with meta-material-enhanced tags,” in Proc. NDSS, pp. 1–17, 2023

    2023

  40. [46]

    LLM self defense: By self examination, LLMs know they are being tricked,

    M. Phute, A. Helbling, M. Hull, S. Peng, S. Szyller, C. Cornelius, and D. H. Chau, “LLM self defense: By self examination, LLMs know they are being tricked,” in Proc. ICLR, pp. 1–11, 2024

    2024

  41. [48]

    Compromising LLM driven embodied agents with contextual backdoor attacks,

    A. Liu, Y . Zhou, X. Liu, T. Zhang, S. Liang, J. Wang, Y . Pu, T. Li, J. Zhang, W. Zhou, Q. Guo, and D. Tao, “Compromising LLM driven embodied agents with contextual backdoor attacks,” IEEE Transactions on Information Forensics and Security , vol. 20, pp. 3979–3994, 2025

    2025

  42. [49]

    BadRobot: Jailbreaking embodied LLMs in the physical world,

    H. Zhang, C. Zhu, X. Wang, Z. Zhou, C. Yin, M. Li, L. Xue, Y . Wang, S. Hu, A. Liu, P. Guo, and L. Y . Zhang, “BadRobot: Jailbreaking embodied LLMs in the physical world,” in Proc. ICLR, pp. 1–40, 2025

    2025

  43. [50]

    Paralyzing drones via EMI signal injection on sensory communication channels.,

    J.-H. Jang, M. Cho, J. Kim, D. Kim, and Y . Kim, “Paralyzing drones via EMI signal injection on sensory communication channels.,” in Proc. NDSS, pp. 1–18, 2023

    2023

  44. [51]

    Remote attacks on drones vision sensors: An empirical study,

    Z. Fu, Y . Zhi, S. Ji, and X. Sun, “Remote attacks on drones vision sensors: An empirical study,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 5, pp. 3125–3135, 2021

    2021

  45. [52]

    Beyond memoriza- tion: Violating privacy via inference with large language models,

    R. Staab, M. Vero, M. Balunovic, and M. Vechev, “Beyond memoriza- tion: Violating privacy via inference with large language models,” in Proc. ICLR, pp. 1–47, 2024

    2024

  46. [53]

    Text embeddings reveal (almost) as much as text,

    J. Morris, V . Kuleshov, V . Shmatikov, and A. Rush, “Text embeddings reveal (almost) as much as text,” in Proc. EMNLP, pp. 12448–12460, 2023

    2023

  47. [54]

    Language models meet world models: embodied experiences enhance language models,

    J. Xiang, T. Tao, Y . Gu, T. Shu, Z. Wang, Z. Yang, and Z. Hu, “Language models meet world models: embodied experiences enhance language models,” in Proc. NeurIPS, pp. 75392–75412, 2023

    2023

  48. [55]

    Data augmentation can improve robustness,

    S.-A. Rebuffi, S. Gowal, D. A. Calian, F. Stimberg, O. Wiles, and T. A. Mann, “Data augmentation can improve robustness,” in Proc. NeurIPS, pp. 29935–29948, 2021

    2021

  49. [56]

    ProPILE: Probing privacy leakage in large language models,

    S. Kim, S. Yun, H. Lee, M. Gubri, S. Yoon, and S. J. Oh, “ProPILE: Probing privacy leakage in large language models,” in Proc. NeurIPS, pp. 1–18, 2023

    2023

  50. [57]

    AutoDefense: Multi- agent LLM defense against jailbreak attacks,

    Y . Zeng, Y . Wu, X. Zhang, H. Wang, and Q. Wu, “AutoDefense: Multi- agent LLM defense against jailbreak attacks,” in NeurIPS Workshop on Safe Generative AI , pp. 1–25, 2024

    2024

  51. [58]

    RAG-Thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks,

    C. Jiang, X. Pan, G. Hong, C. Bao, and M. Yang, “RAG-Thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks,”arXiv preprint arXiv:2411.14110, 2024

    2024 arXiv

  52. [60]

    Mobile edge intelligence for large language models: A contemporary survey,

    G. Qu, Q. Chen, W. Wei, Z. Lin, X. Chen, and K. Huang, “Mobile edge intelligence for large language models: A contemporary survey,” IEEE Communications Surveys & Tutorials , pp. 1–42, 2025

    2025

  53. [62]

    AutoGen: Enabling next-gen LLM applications via multi- agent conversation,

    Q. Wu, G. Bansal, J. Zhang, Y . Wu, B. Li, E. E. Zhu, L. Jiang, X. Zhang, S. Zhang, A. Awadallah, R. W. White, D. Burger, and C. Wang, “AutoGen: Enabling next-gen LLM applications via multi- agent conversation,” in Proc. COLM, pp. 1–43, 2024

    2024

  54. [63]

    Social-aware clustered federated learning with customized privacy preservation,

    Y . Wang, Z. Su, Y . Pan, T. H. Luan, R. Li, and S. Yu, “Social-aware clustered federated learning with customized privacy preservation,” IEEE/ACM Transactions on Networking, vol. 32, no. 5, pp. 3654–3668, 2024

    2024

  55. [2024]

    20, 2025

    Accessed: Jan. 20, 2025

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.