Pith. sign in

REVIEW 3 major objections 7 minor 79 references

Internal neural activations expose stealthy attacks in multi-agent LLM systems and let compromised agents be restored instead of removed.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 20:53 UTC pith:DHW7ZVTT

load-bearing objection Solid systems paper: activation prototypes beat graph detectors on stealthy async MAS attacks, and steering beats isolation on task completion. the 3 major comments →

arxiv 2607.06807 v1 pith:DHW7ZVTT submitted 2026-07-07 cs.CR cs.AI

When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems

Haowen Xu , Xue Tan , Lei Ma , Zhihao Zhang , Chao Wang , Qingze Wang , Ping Chen , Jun Dai
show 1 more author
Xiaoyan Sun
This is my paper
classification cs.CR cs.AI
keywords multi-agent systemsLLM securityactivation-based detectionstealthy attacksasynchronous MASactivation steeringprompt injectionmemory poisoning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Multi-agent systems built on large language models can be attacked in ways that look normal on the surface: malicious logic hidden inside benign-looking prompts, tool outputs, or memory entries. Most existing defenses assume attacks will be obvious in the text or that agents will run in lockstep so their communication graph can be analyzed. This paper claims the earlier, more reliable signal lives inside each agent’s final-layer activations: compromised reasoning drifts away from a simple prototype built from clean runs. By measuring that drift, AcMAS flags bad agents even when execution is asynchronous and surface messages look fine, then steers the activations back toward the normal pattern so the agent keeps working. A reader who cares about real deployments cares because isolating a specialized agent often collapses the whole collaborative task; restoration keeps the system running while stopping the attack.

Core claim

Compromised agents in LLM multi-agent systems produce systematic deviations in final-layer activation space that are detectable without semantic supervision or synchronized rounds. Modeling normal reasoning as a unit-normalized centroid of benign activations, and flagging agents whose cosine divergence exceeds a calibrated threshold, yields high F1 under stealthy prompt injection, tool manipulation, and memory poisoning in both synchronous and asynchronous settings. The same activation signal then drives adaptive steering that restores agent functionality instead of isolating agents, preserving task completion near the clean baseline while driving attack success near zero.

What carries the argument

The normal activation prototype µ_normal (the mean of unit-normalized final-layer hidden states of the last generated token from benign traces) and the per-agent divergence δ_i = 1 − cosine similarity to that prototype. Detection is a threshold test on δ_i; mitigation is the adaptive steering update h̃ = h + λ(µ_normal − h), with λ scaled by how far the agent has drifted past the detection threshold.

Load-bearing premise

Compromised reasoning must leave a detectable mark in final-layer activations relative to a prototype built from a modest set of clean runs; if malicious logic can stay inside that normal cloud while still harming the task, detection fails.

What would settle it

Construct or obtain a stealthy multi-agent attack that systematically produces wrong or harmful outcomes while keeping every compromised agent’s final-layer activation cosine distance to the clean prototype below the paper’s calibrated threshold (around 0.12) across the five reported attack scenarios; if such attacks succeed at scale under AcMAS with low attack-success reduction, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Graph-based detectors that need globally synchronized rounds will degrade sharply on modern asynchronous multi-agent deployments; activation-level monitoring does not.
  • Isolation need not be the default response: agents with specialized roles can be corrected in place, preserving task completion near the clean baseline.
  • Defense can sit locally on each open-weight agent, matching cost- and privacy-driven pipelines that already keep sensitive work on local models.
  • A small set of clean traces (tens, not thousands) is enough to build the prototype, so recalibration under domain shift is cheap and training-free.
  • Final-layer activations of the last generated token carry enough of the reasoning trajectory for both detection and correction across diverse open-source backbones and system scales.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same prototype-and-steer pattern could be applied inside single-agent tool-using loops, not only multi-agent systems.
  • If closed-model providers ever expose limited activation summaries, the method could extend beyond open-weight backbones without full weight access.
  • Attackers who can stay inside the normal activation manifold while still corrupting task outcomes would defeat the detector; measuring how hard that is under realistic communication constraints is a natural next stress test.
  • Combining activation divergence with light message-level checks might cut residual false negatives when attacks only partially succeed.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes AcMAS, an activation-based framework for detecting and mitigating malicious agent behavior in LLM multi-agent systems. It argues that existing defenses rest on two brittle assumptions—semantically explicit attacks and synchronized, graph-modelable interaction rounds—and instead detects compromise via cosine divergence of each agent’s final-layer activation from a normal prototype built from benign traces (Eqs. 10–12), without interaction graphs or temporal alignment. Upon detection it applies adaptive activation steering (Eqs. 14–15) to restore reasoning rather than isolate agents. Evaluation across five stealthy attack settings (S-PI on CSQA/GSM8K, tool manipulation on InjecAgent, memory poisoning on PoisonRAG/HotPotQA), synchronous and asynchronous execution, four open-source backbones, MAS scales 8–80, and attack intensities up to 40%+ reports large F1 gains over graph baselines (especially async) and high task completion with low attack success under correction.

Significance. If the results hold, the work is a clear advance for MAS security: it replaces topology- and output-level detectors with a local, synchronization-agnostic signal and, more importantly, replaces isolation with restorative intervention that preserves collaborative structure (avg TCR ≈ 0.98 vs. isolation baselines ≈ 0.78–0.83). The empirical package is unusually thorough for the area—sync/async, multiple attack families, backbone and scale sweeps, ablations on adaptive update/normalization/correction/layer choice, threshold and prototype-size sensitivity, efficiency breakdown, and honest domain-shift and adaptive-attack discussion. The open-weight activation requirement is scoped to a realistic class of cost- and privacy-aware deployments rather than overclaimed. These strengths make the paper a useful reference point even if some threat-model edges remain open.

major comments (3)
  1. §4.1–4.2 and Table 1: The large async F1 gap (+0.55 vs. G-Safeguard) is a central claim, but the graph baselines (G-Safeguard, BlindGuard, PERM, TAM) are designed for round-aligned interaction graphs. The manuscript does not state whether any async adaptation was attempted (e.g., event-stream or dependency-graph construction) or whether the comparison is strictly against the published sync formulations. Please either document a best-effort async adaptation of at least one graph baseline or explicitly frame the async result as superiority over methods that assume lock-step rounds, so the claim is not over-read as “activation beats any graph approach.”
  2. §1, §3.2–3.3, Appendix A (S-PI constructions): The motivation that modern attacks are “semantically stealthy” and thus defeat output-level semantic analysis is load-bearing for preferring activations over surface text, yet the main tables compare only to graph/GAD methods. Please add a simple output-level semantic or LLM-as-judge detector baseline on the same S-PI instances (or report that such detectors fail at high FPR/FNR) so the claim that surface semantics are insufficient is measured rather than only illustrated by construction.
  3. §5 and the separability premise (Eqs. 10–12): Adaptive attacks that gradually stay inside the normal activation manifold are correctly flagged as open, and the paper’s own evidence is for non-adaptive stealthy constructions. Because separability is the weakest load-bearing assumption, either (i) include a minimal adaptive/gradual-injection stress test with the anomaly-gated update rule sketched in §5, or (ii) tighten abstract and contribution language to scope claims to the evaluated non-adaptive stealthy attacks, so readers do not over-generalize robustness.
minor comments (7)
  1. Abstract vs. §1: reported F1 pairs for sync/async baselines are inconsistent across places (e.g., 0.94 vs. 0.72 / 0.93 vs. 0.38 vs. earlier 0.95 vs. 0.74 / 0.94 vs. 0.46). Align all summary numbers with Table 1 averages.
  2. §3.3 Eq. (13): state how α = 0.7 was chosen (grid search, validation, or default) and whether results are sensitive to α in the same style as the τdetect analysis in §4.5.
  3. Figure 2: the left “Attacked MAS” panel and the right detection/mitigation flow are dense; a short caption walk-through of one agent’s path (extract → δi → λi → steered regeneration) would help.
  4. §4.4 Table 3: “w/o Correction” isolates agents; clarify whether isolation uses the same detection threshold and whether isolated agents are removed for the remainder of the episode or only the current step.
  5. Appendix F.2 domain-shift tables: FPR = 1.0 at ntarget = 0 is expected but stark; a one-sentence practical recommendation in the main §5 (recompute μnormal from 50–100 target traces when domain change is known) would make the limitation actionable.
  6. Notation: H(t) is used both for the activation matrix and, earlier, for sets of normal activations; disambiguate (e.g., Hnormal vs. H(t)).
  7. Related work: A-Trust (attention-based trust) is close in spirit to internal-signal defenses; a sentence contrasting activation prototypes vs. attention-based message trust would sharpen positioning.

Circularity Check

0 steps flagged

No significant circularity: AcMAS is a standard prototype-based anomaly detector with empirical evaluation against labeled attacks and external baselines; thresholds and prototypes are calibrated on held-out benign/validation data without tautological reduction of reported F1/TCR/ASR.

full rationale

The derivation chain is methodological rather than predictive-from-first-principles. Normal prototype μ_normal is the mean of unit-normalized activations from known-benign traces (Eq. 10); per-agent divergence is ordinary cosine distance (Eq. 11); detection is a threshold test au_detect calibrated on a validation set to balance FPR/FNR (Eq. 12 and Appendix D); correction strength λ_i is a clipped linear function of that same divergence (Eqs. 14–15). Performance numbers (F1 0.92–0.95, TCR ≈0.98, ASR ≈0.04) are measured on held-out attack scenarios against independent graph baselines (G-Safeguard, BlindGuard, PERM, TAM) and ablations; none of the reported metrics is forced by construction from the prototype or threshold. Self-citations (e.g., Tan et al. 2024a for representation anomaly detection, Zhang et al. 2025b for steering) supply prior technique, not uniqueness theorems that forbid alternatives or smuggle the result. Domain-shift and sample-efficiency experiments further treat the prototype as an empirical estimate that can be recalibrated, confirming the method is falsifiable rather than definitional. No equation reduces a claimed prediction to its fitted input.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 2 invented entities

The central claim rests on a small set of free calibration constants, standard anomaly-detection assumptions about activation geometry, and the operational entity of a normal activation prototype. No new physical particles or forces are invented; the main postulated object is the prototype μnormal and the claim that malicious MAS behaviors form separable clusters in final-layer activation space.

free parameters (4)
  • τdetect (detection threshold) = 0.12 (avg; range ~0.10–0.14)
    Binary flag threshold on cosine divergence; calibrated on validation to maximize F1 / Youden index. Default 0.12 used across experiments (Appendix D, Table 5).
  • τmax (max divergence for correction scaling) = 0.35
    Normalizes adaptive steering strength λi; set to 95th percentile of malicious divergences on validation. Default 0.35.
  • α (prototype momentum in sync mode) = 0.7
    Exponential moving-average weight for adaptive normal prototype update across rounds (Eq. 13). Hand-set to 0.7.
  • number of benign traces for μnormal = ~50–100 traces
    Prototype sample size; sensitivity shows F1 stabilizes around ~50 traces. Default construction uses on the order of 100 traces in domain-shift experiments.
axioms (5)
  • domain assumption Final-layer last-token hidden state is a sufficient summary of the agent's full reasoning trajectory for anomaly detection.
    Stated in §3.2 with citations to prior activation work; ablation in Table 3 supports final vs early/middle layers but does not prove uniqueness.
  • domain assumption Compromised agents exhibit systematic activation deviations and mutual clustering relative to benign agents (Eq. 8).
    Core enabling claim of §3.2–3.3; treated as empirical observation rather than proved theorem.
  • domain assumption High-level reasoning activation patterns remain consistent enough across diverse async task contexts that a fixed benign prototype works without temporal alignment.
    Explicit design choice for asynchronous MAS in §3.3; failure under strong domain shift is partially quantified in Appendix F.2.
  • domain assumption Adversary can compromise agents and propagate via communication edges, but defender has white-box activation access to local open-weight backbones.
    Threat model §3.1 and open-weight discussion §5 / Appendix C.
  • ad hoc to paper Cosine distance in unit-normalized activation space is an appropriate divergence for flagging malicious reasoning.
    Chosen following prior representation anomaly work; ablation shows normalization matters (Table 3) but alternatives are not exhaustively compared.
invented entities (2)
  • Normal activation prototype μnormal independent evidence
    purpose: Centroid of unit-normalized benign activations used as the sole reference for divergence-based detection and steering target.
    Constructed from clean traces (Eq. 10); not an external physical entity. Independent handle is empirical: new benign traces should land near it, malicious ones far—tested via F1/AUROC and domain-shift recovery.
  • AcMAS adaptive activation-level correction (λ-steering) no independent evidence
    purpose: Restores compromised agents by interpolating activations toward μnormal with strength proportional to divergence, then regenerating the response.
    Operational defense mechanism (Eqs. 14–15). Evidence is TCR/ASR and task accuracy recovery vs isolation baselines (Tables 2, 6), not an external measurement independent of the defense loop.

pith-pipeline@v1.1.0-grok45 · 28980 in / 3843 out tokens · 43966 ms · 2026-07-10T20:53:30.069479+00:00 · methodology

0 comments
read the original abstract

While enabling effective collaboration on complex tasks, LLM-based Multi-Agent Systems (MAS) face critical security challenges due to vulnerabilities at the agent and interaction levels. Most existing MAS security defenses are built upon two core assumptions: semantically-explicit malicious attacks and explicit graph-based modeling of the MAS topology and agent-level interactions. In practice, real-world attacks are becoming more semantically stealthy, while MAS execution is typically asynchronous without the temporal alignment assumed by graph-based propagation models. To address these limitations, we propose AcMAS, an activation-based framework for malicious-behavior detection in MAS. By analyzing internal reasoning states in the activation space of local agents, AcMAS detects even stealthy attacks in a synchronization-robust fashion, without relying on explicit interaction graphs. Moreover, our activation analysis provides critical signals to guide AcMAS in restoring the functionality of compromised agents, rather than the disruptive agent isolation commonly used by the state-of-the-art methods. Comprehensive evaluation demonstrates that AcMAS significantly outperforms graph-based baselines against stealthy attacks, by +0.22 F1 in synchronous settings (0.94 vs. 0.72) and by +0.55 F1 in asynchronous settings (0.93 vs. 0.38), with generalization across diverse open-source LLM backbones, attack intensity, and MAS scale.

Figures

Figures reproduced from arXiv: 2607.06807 by Chao Wang, Haowen Xu, Jun Dai, Lei Ma, Ping Chen, Qingze Wang, Xiaoyan Sun, Xue Tan, Zhihao Zhang.

Figure 1
Figure 1. Figure 1: Attacks in MAS. (Left) Representative attack categories against agents. (Right) Attack propagation examples in MAS under two paradigms: (a) Sync-MAS with lock-step, round-based execution, (b) Async-MAS with event-driven, task-allocation-based execution. ❷ Asynchronous Incompatibility. Some defenses (Miao et al., 2025; Wang et al., 2025b) further assume that agent interactions are globally synchronized, all… view at source ↗
Figure 2
Figure 2. Figure 2: The overall framework of our proposed AcMAS: Left: An attacked MAS where malicious prompts corrupt agent reasoning and disrupt collaborative task execution. Right: AcMAS performs (I) Detection by extracting agent activations h (t) i and identifying anomalies via divergence δi from a normal prototype, applicable to both synchronous and asynchronous settings; and (II) Mitigation through activation-level corr… view at source ↗
Figure 3
Figure 3. Figure 3: Detection accuracy of AcMAS across different MAS scales and LLM backbones. 4.3. Generality of AcMAS. ❸ AcMAS demonstrates generality across diverse LLM backbones and MAS scales. We evaluate AcMAS’s de￾tection performance across four representative LLM archi￾tectures spanning different model families and parameter scales: GPT-OSS-20B, DeepSeek-V3, LLaMA3-8B, and Qwen3-30B-A3B. As illustrated in [PITH_FULL_… view at source ↗
Figure 5
Figure 5. Figure 5: F1 score versus the number of benign traces used to construct the prototype µnormal across all five datasets. traces: F1 rises sharply between 5 and 20 traces and stabi￾lizes around 50 traces, with the gap to the 100-trace default below 0.03 on every dataset. This indicates that prototype construction is highly sample-efficient, which is particularly attractive in deployment settings where collecting clean… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

79 extracted references · 79 canonical work pages · 34 internal anchors

  1. [1]

    Gemini: A Family of Highly Capable Multimodal Models

    Gemini: a family of highly capable multimodal models , author=. arXiv preprint arXiv:2312.11805 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  2. [2]

    Qwen Technical Report

    Qwen technical report , author=. arXiv preprint arXiv:2309.16609 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  3. [3]

    DeepSeek-V3 Technical Report

    Deepseek-v3 technical report , author=. arXiv preprint arXiv:2412.19437 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  4. [4]

    Frontiers of Computer Science , volume=

    A survey on large language model based autonomous agents , author=. Frontiers of Computer Science , volume=. 2024 , publisher=

    work page 2024

  5. [5]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Memorybank: Enhancing large language models with long-term memory , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    work page

  6. [6]

    Advances in Neural Information Processing Systems , volume=

    Hugginggpt: Solving ai tasks with chatgpt and its friends in hugging face , author=. Advances in Neural Information Processing Systems , volume=

    work page

  7. [7]

    Forty-first International Conference on Machine Learning , year=

    Gptswarm: Language agents as optimizable graphs , author=. Forty-first International Conference on Machine Learning , year=

    work page

  8. [8]

    Scaling Large Language Model-based Multi-Agent Collaboration

    Scaling large language model-based multi-agent collaboration , author=. arXiv preprint arXiv:2406.07155 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  9. [9]

    , author=

    Large Language Model based Multi-Agents: A Survey of Progress and Challenges. , author=. 33rd International Joint Conference on Artificial Intelligence (IJCAI 2024) , year=

    work page 2024

  10. [10]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V

    A survey on trustworthy llm agents: Threats and countermeasures , author=. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2 , pages=

    work page

  11. [11]

    2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) , pages=

    Get my drift? catching llm task drift with activation deltas , author=. 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) , pages=. 2025 , organization=

    work page 2025

  12. [12]

    DeepInception: Hypnotize Large Language Model to Be Jailbreaker

    Deepinception: Hypnotize large language model to be jailbreaker , author=. arXiv preprint arXiv:2311.03191 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  13. [13]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Controlling large language models through concept activation vectors , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    work page

  14. [14]

    RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis

    RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis , author=. arXiv preprint arXiv:2411.18948 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  15. [15]

    Findings of the Association for Computational Linguistics ACL 2024 , pages=

    LLM Factoscope: Uncovering LLMs’ Factual Discernment through Measuring Inner States , author=. Findings of the Association for Computational Linguistics ACL 2024 , pages=

    work page 2024

  16. [16]

    Advances in Neural Information Processing Systems , volume=

    Uncovering safety risks of large language models through concept activation vector , author=. Advances in Neural Information Processing Systems , volume=

    work page

  17. [17]

    Get my drift? Catching LLM Task Drift with Activation Deltas

    Are you still on track!? Catching LLM Task Drift with Activations , author=. arXiv preprint arXiv:2406.00799 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  18. [18]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Unveiling privacy risks in llm agent memory , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    work page

  19. [19]

    JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation

    Jbshield: Defending large language models from jailbreak attacks through activated concept analysis and manipulation , author=. arXiv preprint arXiv:2502.07557 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  20. [20]

    Commonsenseqa: A question answering challenge targeting commonsense knowledge , author=. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) , pages=

    work page 2019

  21. [21]

    Training Verifiers to Solve Math Word Problems

    Training verifiers to solve math word problems , author=. arXiv preprint arXiv:2110.14168 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  22. [22]

    arXiv preprint arXiv:2503.07675 , year=

    DynTaskMAS: A Dynamic Task Graph-driven Framework for Asynchronous and Parallel LLM-based Multi-Agent Systems , author=. arXiv preprint arXiv:2503.07675 , year=

    work page arXiv

  23. [23]

    Proceedings of the 2018 conference on empirical methods in natural language processing , pages=

    HotpotQA: A dataset for diverse, explainable multi-hop question answering , author=. Proceedings of the 2018 conference on empirical methods in natural language processing , pages=

    work page 2018

  24. [24]

    2024 , howpublished=

    Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet , author=. 2024 , howpublished=

    work page 2024

  25. [25]

    International Conference on Learning Representations , volume=

    Scaling and evaluating sparse autoencoders , author=. International Conference on Learning Representations , volume=

    work page

  26. [26]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    A Middle Path for On-Premises LLM Deployment: Preserving Privacy Without Sacrificing Model Confidentiality , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    work page 2025

  27. [27]

    Dynamic Model Routing and Cascading for Efficient LLM Inference: A Survey

    Dynamic model routing and cascading for efficient LLM inference: A survey , author=. arXiv preprint arXiv:2603.04445 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  28. [28]

    RouteLLM: Learning to Route LLMs with Preference Data

    Routellm: Learning to route llms with preference data , author=. arXiv preprint arXiv:2406.18665 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  29. [29]

    FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance

    Frugalgpt: How to use large language models while reducing cost and improving performance , author=. arXiv preprint arXiv:2305.05176 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  30. [30]

    Machine learning , volume=

    Adversarial concept drift detection under poisoning attacks for robust data stream mining , author=. Machine learning , volume=. 2023 , publisher=

    work page 2023

  31. [31]

    Computers & Security , volume=

    Practical evaluation of poisoning attacks on online anomaly detectors in industrial control systems , author=. Computers & Security , volume=. 2022 , publisher=

    work page 2022

  32. [32]

    European Conference on Information Retrieval , pages=

    Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems , author=. European Conference on Information Retrieval , pages=. 2025 , organization=

    work page 2025

  33. [33]

    Qwen3 Technical Report

    Qwen3 technical report , author=. arXiv preprint arXiv:2505.09388 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  34. [34]

    LLaMA: Open and Efficient Foundation Language Models

    Llama: Open and efficient foundation language models , author=. arXiv preprint arXiv:2302.13971 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  35. [35]

    gpt-oss-120b & gpt-oss-20b Model Card

    gpt-oss-120b & gpt-oss-20b model card , author=. arXiv preprint arXiv:2508.10925 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  36. [36]

    International conference on machine learning , pages=

    Interpretability beyond feature attribution: Quantitative testing with concept activation vectors (tcav) , author=. International conference on machine learning , pages=. 2018 , organization=

    work page 2018

  37. [37]

    arXiv preprint arXiv:2503.03704 , year=

    A practical memory injection attack against llm agents , author=. arXiv preprint arXiv:2503.03704 , year=

    work page arXiv

  38. [38]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Internal value alignment in large language models through controlled value vector activation , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    work page

  39. [39]

    Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks

    Sentence-bert: Sentence embeddings using siamese bert-networks , author=. arXiv preprint arXiv:1908.10084 , year=

    work page internal anchor Pith review Pith/arXiv arXiv 1908

  40. [40]

    CoRR , year=

    G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems , author=. CoRR , year=

    work page

  41. [41]

    BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks

    Blindguard: Safeguarding llm-based multi-agent systems under unknown attacks , author=. arXiv preprint arXiv:2508.08127 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  42. [42]

    Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems

    Prompt infection: Llm-to-llm prompt injection within multi-agent systems , author=. arXiv preprint arXiv:2410.07283 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  43. [43]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Stepwise reasoning disruption attack of LLMs , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    work page

  44. [44]

    ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs

    Shadowcot: Cognitive hijacking for stealthy reasoning backdoors in llms , author=. arXiv preprint arXiv:2504.05605 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  45. [45]

    NetSafe: Exploring the Topological Safety of Multi-agent Networks

    Netsafe: Exploring the topological safety of multi-agent networks , author=. arXiv preprint arXiv:2410.15686 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  46. [46]

    AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management

    Agentsafe: Safeguarding large language model-based multi-agent systems via hierarchical data management , author=. arXiv preprint arXiv:2503.04392 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  47. [47]

    To trust or not to trust: Attention-based Trust Management for LLM Multi-Agent Systems

    Attention Knows Whom to Trust: Attention-based Trust Management for LLM Multi-Agent Systems , author=. arXiv preprint arXiv:2506.02546 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  48. [48]

    InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents , author=. arXiv preprint arXiv:2403.02691 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  49. [49]

    Proceedings of the 41st International Conference on Machine Learning , pages=

    Agent Smith: a single image can jailbreak one million multimodal LLM agents exponentially fast , author=. Proceedings of the 41st International Conference on Machine Learning , pages=

    work page

  50. [50]

    Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Psysafe: A comprehensive framework for psychological-based attack, defense, and evaluation of multi-agent system safety , author=. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    work page

  51. [51]

    The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative

    The wolf within: Covert injection of malice into mllm societies via an mllm operative , author=. arXiv preprint arXiv:2402.14859 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  52. [52]

    Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    Red-teaming llm multi-agent systems via communication attacks , author=. Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    work page 2025

  53. [53]

    MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures -- A Comprehensive Framework

    MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures--A Comprehensive Framework , author=. arXiv preprint arXiv:2505.18572 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  54. [54]

    CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models

    Corba: Contagious recursive blocking attacks on multi-agent systems based on large language models , author=. arXiv preprint arXiv:2502.14529 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  55. [55]

    arXiv preprint arXiv:2504.00218 , year=

    Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks , author=. arXiv preprint arXiv:2504.00218 , year=

    work page arXiv

  56. [56]

    Evil Geniuses: Delving into the Safety of LLM-based Agents

    Evil geniuses: Delving into the safety of llm-based agents , author=. arXiv preprint arXiv:2311.11855 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  57. [57]

    Prompt Injection attack against LLM-integrated Applications

    Prompt injection attack against llm-integrated applications , author=. arXiv preprint arXiv:2306.05499 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  58. [58]

    First Conference on Language Modeling , year=

    Autogen: Enabling next-gen LLM applications via multi-agent conversations , author=. First Conference on Language Modeling , year=

    work page

  59. [59]

    Multi-Agent Collaboration: Harnessing the Power of Intelligent LLM Agents

    Multi-agent collaboration: Harnessing the power of intelligent llm agents , author=. arXiv preprint arXiv:2306.03314 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  60. [60]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Ai-driven virtual teacher for enhanced educational efficiency: Leveraging large pretrain models for autonomous error analysis and correction , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    work page

  61. [61]

    Memory Injection Attacks on LLM Agents via Query-Only Interaction , author=

    work page

  62. [62]

    Graph Neural Networks Gone Hogwild , author=

    work page

  63. [63]

    Large Language Model for Participatory Urban Planning

    Large language model for participatory urban planning , author=. arXiv preprint arXiv:2402.17161 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  64. [64]

    Forty-first International Conference on Machine Learning , year=

    Improving factuality and reasoning in language models through multiagent debate , author=. Forty-first International Conference on Machine Learning , year=

    work page

  65. [65]

    Proceedings of the 2024 conference on empirical methods in natural language processing , pages=

    Encouraging divergent thinking in large language models through multi-agent debate , author=. Proceedings of the 2024 conference on empirical methods in natural language processing , pages=

    work page 2024

  66. [66]

    Advances in Neural Information Processing Systems , volume=

    Camel: Communicative agents for" mind" exploration of large language model society , author=. Advances in Neural Information Processing Systems , volume=

    work page

  67. [67]

    International Conference on Learning Representations , volume=

    MetaGPT: Meta programming for a multi-agent collaborative framework , author=. International Conference on Learning Representations , volume=

    work page

  68. [68]

    Advances in Neural Information Processing Systems , volume=

    Truncated affinity maximization: One-class homophily modeling for graph anomaly detection , author=. Advances in Neural Information Processing Systems , volume=

    work page

  69. [69]

    2023 IEEE International Conference on Data Mining (ICDM) , year=

    PREM: A Simple Yet Effective Approach for Node-Level Graph Anomaly Detection , author=. 2023 IEEE International Conference on Data Mining (ICDM) , year=

    work page 2023

  70. [70]

    Zhuge, Mingchen and Liu, Haozhe and Faccio, Francesco and Ashley, Dylan R. and Csordás, Róbert and Gopalakrishnan, Anand and Hamdi, Abdullah and Hammoud, Hasan Abed Al Kader and Herrmann, Vincent and Irie, Kazuki and Kirsch, Louis and Li, Bing and Li, Guohao and Liu, Shuming and Mai, Jinjie and Piekos, Piotr and Ramesh, Aditya A. and Schlag, Imanol and Sh...

    work page

  71. [71]

    , author=

    AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviors. , author=. ICLR , year=

    work page

  72. [72]

    Researchagent: Iterative research idea generation over scientific literature with large language models , author=. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    work page 2025

  73. [73]

    MetaAgent: Automatically Constructing Multi-Agent Systems Based on Finite State Machines

    MetaAgent: Automatically Constructing Multi-Agent Systems Based on Finite State Machines , author=. arXiv preprint arXiv:2507.22606 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  74. [74]

    Multi-agent Architecture Search via Agentic Supernet

    Multi-agent architecture search via agentic supernet , author=. arXiv preprint arXiv:2502.04180 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  75. [75]

    AFlow: Automating Agentic Workflow Generation

    Aflow: Automating agentic workflow generation , author=. arXiv preprint arXiv:2410.10762 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  76. [76]

    ICPR , pages=

    Siamese network features for image matching , author=. ICPR , pages=. 2016 , organization=

    work page 2016

  77. [77]

    Sensors , volume=

    Online siamese network for visual object tracking , author=. Sensors , volume=. 2019 , publisher=

    work page 2019

  78. [78]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Deep residual learning for image recognition , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    work page

  79. [79]

    Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS

    Attack the messages, not the agents: A multi-round adaptive stealthy tampering framework for llm-mas , author=. arXiv preprint arXiv:2508.03125 , year=

    work page internal anchor Pith review Pith/arXiv arXiv