Pith. sign in

REVIEW 3 major objections 5 minor 4 cited by

This survey argues that multi-LLM agentic systems at the edge must abandon perimeter-based defenses for zero-trust security, and it presents the first systematic framework and mechanism taxonomy for that shift.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A survey proposing zero-trust architecture for multi-LLM systems in edge computing, with a taxonomy of model- and system-level defenses and a conceptual framework.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection A useful zero-trust survey of multi-LLM edge security whose proposed architecture quietly re-trusts a cloud coordinator. the 3 major comments →

arxiv 2508.19870 v1 pith:O6NHSHXB submitted 2025-08-27 cs.NI

Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey

Yinqiu Liu , Ruichen Zhang , Haoxiang Luo , Yijing Lin , Geng Sun , Dusit Niyato , Hongyang Du , Zehui Xiong
show 4 more authors
Yonggang Wen Abbas Jamalipour Dong In Kim Ping Zhang
This is my paper
classification cs.NI
keywords zero-trust securitymulti-LLM systemsedge general intelligence (EGI)agentic AIprompt injectioncontext-aware access controlcontinuous monitoringblockchain
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey argues that the usual way of securing AI systems — building a trusted perimeter and defending it — cannot protect networks of collaborating LLMs deployed at the edge in applications like autonomous driving, smart healthcare, and smart grids. The paper's central claim is that these multi-LLM systems should adopt zero-trust security: no user, LLM, message, or tool is trusted by default, and every interaction is verified continuously. It offers the first systematic treatment of zero-trust for multi-LLM edge systems, combining a threat analysis (jailbreaks, prompt-injection propagation, consensus manipulation, cross-context data leakage), a unified architectural framework, and a taxonomy of mechanisms split into model-level (identity, context-aware access control, stateless and ephemeral LLMs) and system-level (proactive maintenance, blockchain, micro-segmentation, continuous monitoring). If the claim holds, securing edge AI becomes a systems-engineering problem of continuous verification rather than hardening a boundary.

Core claim

The paper's central claim is that the trust model underlying multi-LLM edge systems must be inverted. Instead of implicitly trusting whatever sits inside a security boundary, the system should treat every user input, every LLM output, every inter-LLM message, and every tool call as potentially hostile and verify it before it acts. The survey grounds this in four zero-trust principles — explicit verification, least privilege, continuous monitoring, and micro-segmentation — and presents a unified framework, following the NIST SP 800-207 standard cited in the paper, in which a cloud LLM acts as policy engine and sole inter-LLM communication gateway, every LLM holds a cryptographic identity, acc

What carries the argument

The central object is the zero-trust multi-LLM framework itself, which the survey builds following the NIST SP 800-207 standard (reference [15] in the paper) and organizes around four principles: explicit verification, least privilege, continuous monitoring, and micro-segmentation. Its load-bearing components are: cryptographic identity and continuous authentication for every LLM; a cloud LLM that serves as policy engine and the sole gateway for inter-LLM communications; context-aware, least-privilege access control; user-input checking and multi-layer output verification; and behavioral auditing with anomaly detection. The model-level versus system-level taxonomy is what carries the literat

Load-bearing premise

The framework makes the cloud LLM the policy engine and the only gateway for all inter-LLM messages, but it never explains how that single controller itself earns trust — if it is compromised, every 'zero-trust' guarantee routes through the attacker.

What would settle it

Compromise, or faithfully simulate compromising, the cloud LLM in the proposed framework and show that the attacker can then intercept or alter inter-LLM traffic despite the identity, verification, and monitoring machinery; alternatively, run the framework on realistic edge hardware and show that continuous authentication and monitoring break the latency or energy budget of a representative autonomous-driving or smart-health workload.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Edge AI deployments get a concrete blueprint: every LLM, user, and tool carries a cryptographic identity, permissions are granted per task and revoked when the task ends, and all inter-LLM traffic passes through a policy-enforcing gateway.
  • The taxonomy lets practitioners map defenses to principles — identity and access-control mechanisms implement explicit verification and least privilege, while stateless or ephemeral LLM management and micro-segmentation implement assume-breach containment.
  • If the framework is adopted, the attacks the paper documents — prompt-injection chains that cascade between LLMs, consensus manipulation by Byzantine agents, and cross-context data leakage — become containable and detectable rather than fatal.
  • Partial adoption is an explicit failure mode: the paper warns that doing only identity verification without continuous monitoring lets attackers persist after an initial compromise (Section 4.3).
  • The paper's own comparison (Table 3) concedes zero-trust carries high operational overhead from continuous authentication, real-time monitoring, and dynamic permission management, so adoption is a security-versus-cost trade, not a free win.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit how the framework's own controller earns trust: the cloud LLM both writes policy and sits on every communication path, so its compromise would route every 'zero-trust' guarantee through the attacker. A natural extension is attesting the policy engine itself, or replacing it with a quorum of mutually verifying controllers.
  • The survey does not quantify the operational cost of continuous verification on resource-constrained edge devices; benchmarking that overhead (latency, energy, bandwidth) in a real testbed would settle whether the blueprint is deployable.
  • A direct empirical test of the paper's motivation is available: compare how far a malicious prompt payload propagates in a perimeter-defended multi-LLM system versus the same system with micro-segmentation and gateway enforcement.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents a survey of security threats in multi-LLM systems deployed for edge general intelligence (EGI) and argues that zero-trust principles ('never trust, always verify') are the appropriate security paradigm for such systems. It systematically reviews intra-LLM and inter-LLM vulnerabilities, critiques perimeter-based defenses, and proposes a reference framework inspired by NIST SP 800-207 in which mobile-edge LLMs are authenticated, authorized, and monitored under the control of a cloud LLM acting as policy engine and communication gateway. The survey then categorizes recent zero-trust mechanisms into model-level approaches (identity, access control, stateless/ephemeral management) and system-level approaches (proactive maintenance, blockchain/distributed management, micro-segmentation, monitoring). The paper claims to be the first systematic treatment of zero-trust for multi-LLM systems and concludes with research directions.

Significance. If the framework's architectural inconsistency is resolved, the survey would be a useful reference: it compiles a broad and current bibliography, provides a clear threat taxonomy, and makes a reasonable case that perimeter-based defenses are insufficient for collaborative LLM systems. The strengths are the explicit comparison of traditional and zero-trust approaches (Table 3), the organization of scattered defenses into coherent categories, and the use of NIST SP 800-207 as a concrete anchor. The paper does not provide implementations or quantitative evaluations, which is acceptable for a survey, but the proposed framework is more than a summary: it is a prescriptive architecture that is claimed to satisfy zero-trust properties. That claim is currently not supported because the framework centralizes trust in the cloud LLM.

major comments (3)
  1. [§4.1.2, §4.1.4, §4.2, vs. §3.2.4] The framework's cloud LLM is simultaneously the policy engine (§4.1.2), the sole inter-LLM communication gateway (§4.1.4), the identity/authentication authority (§4.1.3), and the entity that isolates compromised LLMs during continuous monitoring (§4.2). Under the paper's own 'never trust, always verify' principle and its statement in Table 3 that 'no component and entity should be unconditionally trusted at any time', this component must itself be verified and must not be a single point of failure. The paper does not explain how the cloud LLM earns trust, what attests its integrity, or what happens if it is Byzantine. The paper actually acknowledges in §3.2.4 that a compromised central coordinator can propagate biased plans, suppress valid alternatives, and selectively misinform subordinates — exactly the role the cloud LLM plays. The framework therefore does not eliminate implicit trust
  2. [§4.1.4] The text states: 'transmitted content is encrypted using the sender LLM’s public key and decrypted at the receiver using private keys'. This is cryptographically incorrect. For confidentiality, the sender should encrypt with the receiver's public key so that the receiver can decrypt with its own private key; using the sender's public key would only permit verification of a signature, not confidential transmission. The framework's communication security is a core zero-trust mechanism, so this specification error should be corrected and the surrounding text checked for similar confusions between encipherment and signing.
  3. [§5.3.1] The paper categorizes PagedAttention [111] and vAttention [112] as mechanisms for 'stateless LLM management' that provide security isolation: it claims that PagedAttention implements 'process-like isolation' with 'complete isolation between requests' and that vAttention provides 'hardware-level isolation' in protected address spaces. These systems are primarily performance-oriented memory-management techniques for LLM serving; their isolation is about memory efficiency and request scheduling, not adversarial security. Presenting them as zero-trust security mechanisms overstates their guarantees and weakens the credibility of the model-level taxonomy. The survey should either add a clear qualifier that these are enabling techniques whose security properties are not established against malicious tenants, or replace them with systems explicitly designed for security isolation.
minor comments (5)
  1. [§4.2] The text says 'Four major steps are included', but the enumerated workflow contains five bullets (Startup and LLM Authentication; Prompt Understanding; Collaborative Decision Planning; Policy-Governed Plan Execution; Continuous Monitoring and Threat Mitigation). Adjust the count or restructure the list.
  2. [§1.1, footnote 2] The concrete performance numbers ('reducing response latency by up to 50% and operational costs by 30%') are taken from an AWS marketing blog. For a survey, such figures should be labeled as vendor-reported anecdotal evidence or replaced with peer-reviewed measurements, since they are otherwise presented as established facts.
  3. [References] There are duplicate entries: [6] and [61] are the same paper (Xu et al., 'A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models'), and [21] and [94] are the same paper (Gan et al., 'Navigating the Risks...'). Please consolidate and renumber.
  4. [Fig. 4, lower panel] The label 'Cloud LLM servers as the communication gateway' contains a typo; 'servers' should be 'serves'. Also, the figure legend says 'Workflow' but the lower panel is not clearly aligned with the five workflow bullets in §4.2.
  5. [§6.2] The discussion of MPC and ZKP appears under 'Blockchain and Distributed Management', but these techniques are not blockchain-specific. Consider broadening the section heading or providing a transition sentence explaining why MPC/ZKP are included here rather than under cryptographic mechanisms.

Circularity Check

0 steps flagged

No circular derivation found; the survey's framework is anchored to an external standard, and the flagged cloud-LLM trust anomaly is a design-consistency risk, not a circular reduction.

full rationale

This is a survey with no fitted parameters, no derived predictions, and no equations that reduce to their own inputs. The zero-trust multi-LLM framework is explicitly anchored to NIST SP 800-207 [15], an external standard, and the surveyed mechanisms are cited from independent, mostly non-overlapping prior work. Self-citations such as [24] (Luo et al., multi-LLM/EGI survey), [132] (LightChain), and [136] (trustworthy multi-LLM network) are used as background pointers and are not load-bearing: none is invoked as a uniqueness theorem, none forbids alternative designs, and none is the sole support for the central framework. The 'first systematic treatment' claim is a scope/novelty claim, not a mathematical derivation. The strongest flagged issue is architectural consistency rather than circularity: Section 4.1.2 states 'cloud LLMs function as policy engines that establish and enforce security protocols throughout the distributed multi-LLM network,' and Section 4.1.4 states 'all inter-LLM communications within the multi-LLM system are channeled through a secure gateway deployed on the cloud LLM.' This implicitly trusts a centralized component under the paper's own 'never trust, always verify' principle, and Section 3.2.4 acknowledges that a compromised coordinator can propagate biased plans and suppress alternatives. That is a substantive security-design limitation and a correctness risk, but it does not make the survey's claims reduce to their inputs by construction, so the circularity score remains low.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

The survey's central claim depends on the transferability of zero-trust from network security to LLM systems, which is asserted rather than demonstrated. It also assumes a cloud LLM can act as a trusted policy engine, creating a potential single point of failure that conflicts with the zero-trust premise. No free parameters are fitted, and no new entities are introduced.

axioms (4)
  • domain assumption Zero-trust principles (never trust, always verify) apply coherently to LLM-based multi-agent systems.
    Introduced in Section 2.3.1 for network security, then asserted in Section 3.4 to transfer to multi-LLM systems without empirical demonstration. This is the load-bearing premise of the survey.
  • domain assumption Multi-LLM systems are the key enabler of Edge General Intelligence.
    Stated in Section 2.2.1 as the basis for the survey, citing earlier surveys [4,5]. This framing justifies the focus on multi-LLM deployments at the edge.
  • ad hoc to paper The cloud LLM can serve as the policy engine and communication gateway while remaining trustworthy.
    Sections 4.1.2 and 4.1.4 designate the cloud LLM as a centralized policy engine and gateway. This creates a trusted component whose compromise would undermine zero-trust, and the paper does not resolve this tension.
  • domain assumption The enumerated threat categories (jailbreaks, prompt injection, consensus manipulation, etc.) are real and material in EGI deployments.
    Section 3 lists threats with supporting examples from the literature, but their severity in actual edge deployments is assumed rather than measured in this paper.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey." pith.science (2026). https://pith.science/paper/O6NHSHXB

@misc{pith2026250819870,
  author       = {Pith},
  title        = {Pith review of: Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/O6NHSHXB}},
  note         = {Machine review of arXiv:2508.19870}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Agentification serves as a critical enabler of Edge General Intelligence (EGI), transforming massive edge devices into cognitive agents through integrating Large Language Models (LLMs) and perception, reasoning, and acting modules. These agents collaborate across heterogeneous edge infrastructures, forming multi-LLM agentic AI systems that leverage collective intelligence and specialized capabilities to tackle complex, multi-step tasks. However, the collaborative nature of multi-LLM systems introduces critical security vulnerabilities, including insecure inter-LLM communications, expanded attack surfaces, and cross-domain data leakage that traditional perimeter-based security cannot adequately address. To this end, this survey introduces zero-trust security of multi-LLM in EGI, a paradigmatic shift following the ``never trust, always verify'' principle. We begin by systematically analyzing the security risks in multi-LLM systems within EGI contexts. Subsequently, we present the vision of a zero-trust multi-LLM framework in EGI. We then survey key technical progress to facilitate zero-trust multi-LLM systems in EGI. Particularly, we categorize zero-trust security mechanisms into model- and system-level approaches. The former and latter include strong identification, context-aware access control, etc., and proactive maintenance, blockchain-based management, etc., respectively. Finally, we identify critical research directions. This survey serves as the first systematic treatment of zero-trust applied to multi-LLM systems, providing both theoretical foundations and practical strategies.

Figures

Figures reproduced from arXiv: 2508.19870 by Abbas Jamalipour, Dong In Kim, Dusit Niyato, Geng Sun, Haoxiang Luo, Hongyang Du, Ping Zhang, Ruichen Zhang, Yijing Lin, Yinqiu Liu, Yonggang Wen, Zehui Xiong.

Figure 1
Figure 1. Figure 1: The structure of the paper. architectural design and operational workflows. Sections 5 and 6 present an extensive review of zero-trust security mechanisms. The identification and discussion of critical future research directions are presented in Section 7. Finally, Section 8 concludes this survey. 2 FUNDAMENTALS AND PRELIMINARIES 2.1 Multi-LLM Systems LLMs represent a revolutionary advancement in AI, evolv… view at source ↗
Figure 2
Figure 2. Figure 2: Background and preliminaries. (left): The mechanisms of multi-LLM systems. (middle): The vision of [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The representative perimeter-based security defenses for multi-LLM systems. We can observe that [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The vision of zero-trust multi-LLM in EGI. The upper part illustrates a scenario of autonomous driving, [PITH_FULL_IMAGE:figures/full_fig_p017_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: (left): The illustration of Guardian [130]. It analyzes the collaboration pattern of multiple LLMs to detect potential risks and make proactive maintenance. (right): The illustration of SentinelAgent [131]. It monitors all logs and behaviors in multi-LLM systems and utilizes an LLM to analyze data intelligently. throughout the edge network before detection. The zero-trust principle of “never trust, always … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Generative Intent Prediction Agentic AI empowered Edge Service Function Chain Orchestration

    cs.NI 2026-01 unverdicted novelty 6.0

    A framework applies generative diffusion models to predict implicit user intents and proactively orchestrate edge service function chains.

  2. Agentic IoT: Architectures, Applications, and Challenges Toward the Internet of Agents

    cs.AI 2026-07 conditional novelty 5.0

    Agentic IoT is formalized as a cognitive IoT paradigm that embeds LLM-driven agents with perception-reasoning-planning-action-learning loops into cyber-physical systems across the device-edge-fog-cloud continuum.

  3. SoK: Security of Autonomous LLM Agents in Agentic Commerce

    cs.CR 2026-04 unverdicted novelty 5.0

    The paper systematizes security for LLM agents in agentic commerce into five threat dimensions, identifies 12 cross-layer attack vectors, and proposes a layered defense architecture.

  4. Cost and Accuracy of Long-Term Memory in Distributed Multi-Agent Systems Based on Large Language Models

    cs.IR 2026-01 reject novelty 5.0

    A two-framework testbed comparison claims mem0 is Pareto-optimal over Graphiti for distributed LLM agents because its lower cost is paired with accuracy that is not significantly different.

Reference graph

Works this paper leans on

149 extracted references · 35 canonical work pages · cited by 4 Pith papers · 5 internal anchors

  1. [1]

    Yingxuan Yang et al. 2024. LLM-based Multi-Agent Systems: Techniques and Business Perspectives. ArXiv preprint: ArXiv:2411.14033 (2024)

    Pith/arXiv arXiv 2024

  2. [2]

    Deepak Bhaskar Acharya, Karthigeyan Kuppan, and B. Divya. 2025. Agentic AI: Autonomous Intelligence for Complex Goals—A Comprehensive Survey. IEEE Access 13 (2025), 18912–18936

    2025

  3. [3]

    Ahmet Gunduz, Kamer Ali Yuksel, and Hassan Sawaf. 2025. MediaMind: Revolutionizing Media Monitoring using Agentification. ArXiv preprint: ArXiv:2502.12745 (2025)

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  4. [4]

    Handi Chen et al. 2024. Towards Edge General Intelligence via Large Language Models: Opportunities and Challenges. ArXiv preprint: ArXiv:2410.18125 (2024)

    Pith/arXiv arXiv 2024

  5. [5]

    Le He et al. 2025. The Road Toward General Edge Intelligence: Standing on the Shoulders of Foundation Models. IEEE Communications Magazine (2025), 1–7

    2025

  6. [6]

    Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024. A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models. In Proc. ACL Findings. 7432–7449

    2024

  7. [7]

    Yi Liu et al. 2023. Prompt Injection attack against LLM-integrated Applications. ArXiv preprint: ArXiv:2306.05499 (2023)

    Pith/arXiv arXiv 2023

  8. [8]

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. In Proc. NeurIPS. 1–29

    2024

  9. [9]

    Ronny Ko et al. 2025. Seven Security Challenges That Must be Solved in Cross-domain Multi-agent LLM Systems. ArXiv preprint: ArXiv:2505.23847 (2025)

    Pith/arXiv arXiv 2025

  10. [10]

    Lei Yu, Virginie Do, Karen Hambardzumyan, and Nicola Cancedda. 2024. Robust LLM safeguarding via refusal feature adversarial training. ArXiv preprint: ArXiv:2409.20089 (2024)

    Pith/arXiv arXiv 2024

  11. [11]

    Zachary Charles et al. 2024. Fine-Tuning Large Language Models with User-Level Differential Privacy. ArXiv preprint: ArXiv:2407.07737 (2024)

    Pith/arXiv arXiv 2024

  12. [12]

    Wei Yu et al. 2022. TEE based Cross-silo Trustworthy Federated Learning Infrastructure. In Proc. IJCAI

    2022

  13. [13]

    Yifan Zeng et al. 2024. AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks. In Proc. NeurIPS

    2024

  14. [14]

    OpenAI et al. 2023. GPT-4 Technical Report. arXiv preprint arXiv:2303.08774 (2023)

    Pith/arXiv arXiv 2023

  15. [15]

    [n. d.]. NIST Zero trust standard. 2025. https://www.nist.gov/publications/zero-trust-architecture

    2025

  16. [16]

    Xinye Cao et al. 2025. Exploring LLM-Based Multi-Agent Situation Awareness for Zero-Trust Space-Air-Ground Integrated Network. IEEE Journal on Selected Areas in Communications 43, 6 (2025), 2230–2247

    2025

  17. [17]

    Alexandre Poirrier, Laurent Cailleux, and Thomas Heide Clausen. 2025. Is Trust Misplaced? A Zero-Trust Survey. Proc. IEEE 113, 1 (2025), 5–39. ACM Comput. Surv., Vol. 9, No. 9, Article 35. Publication date: September 2025. Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey 35:31

    2025

  18. [18]

    Hadi Amini, and Yanzhao Wu

    Badhan Chandra Das, M. Hadi Amini, and Yanzhao Wu. 2025. Security and Privacy Challenges of Large Language Models: A Survey. ACM Computing Survey 57, 6 (Feb. 2025), 1–39

    2025

  19. [19]

    Francisco Aguilera-Martínez and Fernando Berzal. 2025. LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasures. ArXiv preprint: ArXiv:2505.01177 (2025)

    Pith/arXiv arXiv 2025

  20. [20]

    Othmane Friha, Mohamed Amine Ferrag, Burak Kantarci, Burak Cakmak, Arda Ozgun, and Nassira Ghoualmi- Zine. 2024. LLM-Based Edge Intelligence: A Comprehensive Survey on Architectures, Applications, Security and Trustworthiness. IEEE Open Journal of the Communications Society 5 (2024), 5799–5856

    2024

  21. [22]

    Yang Liu et al. 2024. Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models’ Alignment. ArXiv preprint: ArXiv: 2308.05374 (2024)

    Pith/arXiv arXiv 2024

  22. [23]

    Dezhang Kong et al. 2025. A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures. ArXiv preprint: ArXiv:2506.19676 (2025)

    arXiv 2025

  23. [24]

    Haoxiang Luo et al. 2025. Toward Edge General Intelligence with Multiple-Large Language Model (Multi-LLM): Architecture, Trust, and Orchestration. ArXiv preprint: ArXiv:2507.00672 (2025)

    Pith/arXiv arXiv 2025

  24. [25]

    Pierre Peigne et al. 2024. Multi-Agent Security Tax: Trading Off Security and Collaboration Capabilities in Multi-Agent Systems. In Proc. AAAI. 27573–27581

    2024

  25. [26]

    Shih-Han Chan. 2025. Encrypted Prompt: Securing LLM Applications Against Unauthorized Actions. ArXiv preprint: ArXiv:2503.23250 (2025)

    Pith/arXiv arXiv 2025

  26. [27]

    Zitong Shi et al . 2025. Privacy-Enhancing Paradigms within Federated Multi-Agent Systems. ArXiv preprint: ArXiv:2503.08175 (2025)

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  27. [28]

    Peng Xiao, Shunkun Yang, Hailin Wang, Zhenhong Zhang, and Chunsheng Zou. 2025. Privacy-preserving revocable access control for LLM-driven electrical distributed systems. Peer-to-Peer Networking and Applications 18, 148 (2025), 1–12

    2025

  28. [29]

    Usama Arshad and Zahid Halim. 2025. BlockLLM: A futuristic LLM-based decentralized vehicular network architecture for secure communications. Computers and Electrical Engineering 123 (Jan. 2025), 1–39

    2025

  29. [30]

    Sizhe Chen, Yizhu Wang, Nicholas Carlini, Chawin Sitawarin, and David Wagner. 2025. Defending Against Prompt Injection With a Few DefensiveTokens. ArXiv preprint: ArXiv:2507.07974 (2025)

    Pith/arXiv arXiv 2025

  30. [32]

    Zan-Kai Chong, Hiroyuki Ohsaki, and Bryan Ng. 2025. LLM-Net: Democratizing LLMs-as-a-Service through Blockchain-based Expert Networks. ArXiv preprint: ArXiv:2501.07288 (2025)

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  31. [33]

    Jing Wang, Xue Yuan, Yingjie Xu, Yudi Zhang, and Guowen Xu. 2024. An Efficient Multiparty Threshold ECDSA Protocol against Malicious Adversaries for Blockchain-Based LLMs. IET Information Security 2024 (2024), 1–12

    2024

  32. [34]

    [n. d.]. OpenAI ChatGPT. 2025. https://openai.com/index/chatgpt/

    2025

  33. [35]

    Alexander Kirillov et al. 2023. Segment Anything. In Proc. ICCV. 4015–4026

    2023

  34. [36]

    Qingyu Wu et al. 2024. AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversations. In Proc. COLM. 1–46

    2024

  35. [37]

    Sirui Hong et al. 2024. MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework. In Proc. ICLR. 1–29

    2024

  36. [38]

    Tenenbaum, and Igor Mordatch

    Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, and Igor Mordatch. 2024. Improving factuality and reasoning in language models through multiagent debate. In Proc. ICML. 11733 – 11763

    2024

  37. [39]

    Xinyi Li, Sai Wang, Siqi Zeng, Yu Wu, and Yi Yang. 2024. A survey on LLM-based multi-agent systems: workflow, infrastructure, and challenges. Vicinagearth 1, 9 (2024), 1–43

    2024

  38. [40]

    Guibin Zhang et al . 2025. G-Designer: Architecting Multi-Agent Communication Topologies via Graph Neural Networks. In Proc. ICLR. 1–12

    2025

  39. [41]

    Ehud Karpas et al. 2022. MRKL systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning. ArXiv preprint: ArXiv:2205.00445 (2022)

    Pith/arXiv arXiv 2022

  40. [42]

    Abul Ehtesham, Aditi Singh, Gaurav Kumar Gupta, and Saket Kumar. 2025. A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP). ArXiv preprint: ArXiv:2505.02279 (2025)

    Pith/arXiv arXiv 2025

  41. [43]

    Yu Du, Jun Li, Long Shi, Tingting Liu, Feng Shu, and Zhu Han. 2022. Two-Tier Matching Game in Small Cell Networks for Mobile Edge Computing. IEEE Transactions on Services Computing 15, 1 (2022), 254–265

    2022

  42. [44]

    Yung-Yao Chen, Sin-Ye Jhong, Shao-Kai Tu, Yu-Hsiu Lin, and Yi-Chen Wu. 2024. Autonomous Smart-Edge Fault Diagnostics via Edge-Cloud-Orchestrated Collaborative Computing for Infrared Electrical Equipment Images. IEEE Sensors Journal 24, 15 (2024), 24630–24648. ACM Comput. Surv., Vol. 9, No. 9, Article 35. Publication date: September 2025. 35:32 Y. Liu et al

    2024

  43. [45]

    Sébastien Bubeck et al. 2023. Sparks of Artificial General Intelligence: Early experiments with GPT-4. ArXiv preprint: ArXiv:2303.12712 (2023)

    Pith/arXiv arXiv 2023

  44. [46]

    Jan Clusmann et al. 2023. The future landscape of large language models in medicine. Communications Medcine 3, 141 (2023), 1–8

    2023

  45. [47]

    Senkang Hu, Zhengru Fang, Zihan Fang, Yiqin Deng, Xianhao Chen, and Yuguang Fang. 2025. AgentsCoDriver: Large Language Model Empowered Collaborative Driving with Lifelong Learning. ArXiv preprint: ArXiv:2404.06345 (2025)

    Pith/arXiv arXiv 2025

  46. [48]

    Xiaozhi Deng, Tengteng Ma, Haobin Li, and Mingxin Lu. 2024. Federated Large Language Models for Smart Grid: A Communication Efficient LoRA Approach. In Proc. ICCASIT. 1369–1374

    2024

  47. [49]

    Hrishikesh Joshi. 2025. Emerging Technologies Driving Zero Trust Maturity Across Industries. IEEE Open Journal of the Computer Society 6 (2025), 25–36

    2025

  48. [50]

    Khowaja, Parus Khuwaja, Kapal Dev, Keshav Singh, Xingwang Li, Nikolaos Bartzoudis, and Ciprian R

    Sunder A. Khowaja, Parus Khuwaja, Kapal Dev, Keshav Singh, Xingwang Li, Nikolaos Bartzoudis, and Ciprian R. Comsa. 2025. Block Encryption LAyer (BELA): Zero-Trust Defense Against Model Inversion Attacks for Federated Learning in 5G/6G Systems. IEEE Open Journal of the Communications Society 6 (2025), 807–819

    2025

  49. [51]

    Qingxuan Wang and Ding Wang. 2023. Understanding Failures in Security Proofs of Multi-Factor Authentication for Mobile Devices. IEEE Transactions on Information Forensics and Security 18 (2023), 597–612

    2023

  50. [52]

    Wentao Jing, Linning Peng, Hua Fu, and Aiqun Hu. 2024. An Authentication Mechanism Based on Zero Trust With Radio Frequency Fingerprint for Internet of Things Networks. IEEE Internet of Things Journal 11, 13 (2024), 23683–23698

    2024

  51. [53]

    Sungmin Hong, Lei Xu, Jianwei Huang, Hongda Li, Hongxin Hu, and Guofei Gu. 2023. SysFlow: Toward a Pro- grammable Zero Trust Framework for System Security. IEEE Transactions on Information Forensics and Security 18 (2023), 2794–2809

    2023

  52. [54]

    Lan Zhou, Vijay Varadharajan, and Michael Hitchens. 2013. Achieving Secure Role-Based Access Control on Encrypted Data in Cloud Storage. IEEE Transactions on Information Forensics and Security 8, 12 (2013), 1947–1960

    2013

  53. [55]

    Marcela Tuler De Oliveira, Lúcio Henrik Amorim Reis, Yiannis Verginadis, Diogo Menezes Ferrazani Mattos, and Sílvia Delgado Olabarriaga. 2022. SmartAccess: Attribute-Based Access Control System for Medical Records Based on Smart Contracts. IEEE Access 10 (2022), 117836–117854

    2022

  54. [56]

    Pejman Najafi, Daniel Koehler, Feng Cheng, and Christoph Meinel. 2021. NLP-based Entity Behavior Analytics for Malware Detection. In Proc. IPCCC. 1–5

    2021

  55. [57]

    Manadhata, and Loai Zomlot

    Sandeep Bhatt, Pratyusa K. Manadhata, and Loai Zomlot. 2014. The Operational Role of Security Information and Event Management Systems. IEEE Security & Privacy 12, 5 (2014), 35–41

    2014

  56. [58]

    Eranga Bandara, Xueping Liang, Sachin Shetty, Ravi Mukkamala, Abdul Rahman, and Ng Wee Keong. 2022. Skunk — A Blockchain and Zero Trust Security Enabled Federated Learning Platform for 5G/6G Network Slicing. In Proc. SECON. 109–117

    2022

  57. [59]

    Liv d’Aliberti, Evan Gronberg, and Joseph Kovba. 2024. Privacy-Enhancing Technologies for Artificial Intelligence- Enabled Systems. In Proc. IWSPA

    2024

  58. [60]

    Rui Zhao, Ziguo Chen, Yuze Fan, Yun Li, and Fei Gao. 2024. Towards Robust Decision-Making for Autonomous Highway Driving Based on Safe Reinforcement Learning. Sensors 24, 13 (2024)

    2024

  59. [61]

    Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024. A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models. In Proc. ACL. 7432–7449

    2024

  60. [62]

    Zeyi Liao and Huan Sun. 2024. AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs. In Proc. COLM. 1–14

    2024

  61. [63]

    Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang. 2024. LLM Agents can Autonomously Exploit One-day Vulnerabilities. ArXiv preprint: ArXiv:2404.08144 (2024)

    Pith/arXiv arXiv 2024

  62. [64]

    Nicholas Carlini et al . 2021. Extracting Training Data from Large Language Models. In Proc. USENIX Security . 2633–2650

    2021

  63. [65]

    Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. 2022. Quantifying Privacy Risks of Prompting Large Language Models. arXiv preprint arXiv:2210.17012 (2022)

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  64. [66]

    Pranab Sahoo, Prabhash Meharia, Akash Ghosh, Sriparna Saha, Vinija Jain, and Aman Chadha. 2024. A Comprehensive Survey of Hallucination in Large Language, Image, Video and Audio Foundation Models. InProc. EMNLP. 11709–11724

    2024

  65. [67]

    Donghyun Lee and Mo Tiwari. 2024. Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems. ArXiv preprint: ArXiv:2410.07283 (2024)

    Pith/arXiv arXiv 2024

  66. [68]

    Xu Shen et al. 2025. Understanding the Information Propagation Effects of Communication Topologies in LLM-based Multi-Agent Systems. ArXiv preprint: ArXiv:2505.23352 (2025)

    Pith/arXiv arXiv 2025

  67. [69]

    Rupeng Zhang et al. 2025. From Allies to Adversaries: Manipulating LLM Tool-Calling through Adversarial Injection. In Proc. NAACL. 2009–2028

    2025

  68. [70]

    Pengfei He, Yupin Lin, Shen Dong, Han Xu, Yue Xing, and Hui Liu. 2025. Red-Teaming LLM Multi-Agent Systems via Communication Attacks. arXiv preprint arXiv:2502.14847 (2025). ACM Comput. Surv., Vol. 9, No. 9, Article 35. Publication date: September 2025. Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey 35:33

    Pith/arXiv arXiv 2025

  69. [71]

    Yuyang Zhang, Kangjie Chen, Jiaxin Gao, Ronghao Cui, Run Wang, Lina Wang, and Tianwei Zhang. 2024. Towards Action Hijacking of Large Language Model-based Agent. arXiv preprint arXiv:2412.10807 (2024)

    Pith/arXiv arXiv 2024

  70. [72]

    Gurusha Juneja, Alon Albalak, Wenyue Hua, and William Yang Wang. 2025. MAGPIE: A dataset for Multi-AGent contextual PrIvacy Evaluation. ArXiv preprint: ArXiv:2506.20737 (2025)

    Pith/arXiv arXiv 2025

  71. [73]

    Haibo Jin, Ruoxi Chen, Peiyan Zhang, Andy Zhou, Yang Zhang, and Haohan Wang. 2025. GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of LLMs. ArXiv preprint: ArXiv:2402.03299 (2025)

    arXiv 2025

  72. [74]

    Marcin Chrapek, Anjo Vahldiek-Oberwagner, Marcin Spoczynski, Scott Constable, Mona Vij, and Torsten Hoefler

  73. [75]

    Assaf Namer, Prashant Kulkarni, Erik Jeansson, Brandon Maltzman, and Hauke Vagts. 2025. Automatically Detecting Expensive Prompts and Configuring Firewall Rules to Mitigate Denial of Service Attacks on Large Language Models. https://www.tdcommons.org/dpubs_series/6642/ (2025)

    2025

  74. [76]

    Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. 2025. Efficient adversarial training in LLMs with continuous attacks. In Proc. NeurIPS. 1502 – 1530

    2025

  75. [77]

    Dazhen Deng, Chuhan Zhang, Huawei Zheng, Yuwen Pu, Shouling Ji, and Yingcai Wu. 2025. AdversaFlow: Visual Red Teaming for Large Language Models with Multi-Level Adversarial Flow. IEEE Transactions on Visualization and Computer Graphics 31, 1 (2025), 492–502

    2025

  76. [78]

    Rouzbeh Behnia, Mohammadreza Reza Ebrahimi, Jason Pacheco, and Balaji Padmanabhan. 2022. EW-Tune: A Framework for Privately Fine-Tuning Large Language Models with Differential Privacy. InProc. ICDMW. 560–566

    2022

  77. [79]

    Juntao Dai et al. 2024. Safe RLHF: Safe Reinforcement Learning from Human Feedback. In Proc. ICML. 1–28

    2024

  78. [80]

    Zhendan Sun and Ruibin Zhao. 2025. LLM Security Alignment Framework Design Based on Personal Preference. In Proc. AIFE. 6–11

    2025

  79. [81]

    Petr Spelda and Vit Stritecky. 2025. Security practices in AI development. AI & Society (2025), 1–11

    2025

  80. [82]

    Mansi Phute, Alec Helbling, Matthew Daniel Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2024. LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked. In Proc. ICLR. 1–6

    2024

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.