Pith. sign in

REVIEW 4 major objections 5 minor 29 references

Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Structured multi-agent LLM pipelines are vulnerable by design: absent boundary checks let injected content flow as trusted input to every downstream agent.

desk verdict Solid empirical taxonomy and a controlled cross-model study, but the paper's central 'architectural property' claim is forced by a circular Equation (10) and should be rephrased as a hypothesis. read the letter →

arxiv 2608.00718 v1 pith:USHXSJOU submitted 2026-08-01 cs.CR cs.AIcs.MA

Faisal Haque Bappy , Tahrim Hossain , Tarannum Shaila Zaman , Raiful Hasan , Kamrul Hasan , Tariqul Islam This is my paper · ORCID
classification cs.CRcs.AIcs.MA
keywords multi-agentLLMpipelinesboundaryverificationpromptinjectionarchitecturalvulnerabilityagentimpersonationplanhijackingconsensuspoisoningattackpropagation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Multi-agent LLM pipelines pass intermediate outputs between specialized agents, and this paper argues that the resulting security risk is a property of the pipeline's architecture, not of the underlying language model. The core claim is that current pipelines lack 'boundary verification,' so content, delegation plans, and agent identities are never checked as data crosses between agents; once one agent accepts adversarial content, it is forwarded as trusted input to the rest of the system. The paper supports this with annotated production traces, showing four vulnerability classes arise in benign deployments and are invisible to existing evaluation rubrics, and with controlled attacks in a ten-agent, five-layer pipeline across three different models. Because attack success varies little across models but substantially across attack types, the authors conclude that hardening a model is insufficient and that defenses must be built into the pipeline boundaries themselves.

What carries the argument

The load-bearing object is the boundary check $B_k$, a predicate on messages traversing inter-agent edges, $B_k: M \times E \to \{0,1\}$, which a well-formed pipeline would evaluate at every handoff. The paper's formal claim is that attack success $S(G, M_{\mathrm{LLM}}, A_k) = \Pr_{m,(a_i,a_j) \sim G}[B_k(m,(a_i,a_j)) = 0]$ contains no term for the backbone model $M_{\mathrm{LLM}}$, so once a check is absent the attack succeeds regardless of model. This identity is what converts the empirical observation of small cross-model differences into the architectural conclusion; accordingly, the paper treats sanitization at retrieval, plan-to-trace enforcement, and credential verification as checks that no model can perform on itself because they sit on messages crossing boundaries, not tokens inside one context.

What would settle it

Run the same four attack classes across a much larger and more diverse set of backbone models with enough trials to resolve small inter-model differences; if inter-model attack-success differences grow to rival the inter-attack spread, the architectural conclusion fails. A complementary decisive test: add only one boundary verifier, such as a retrieval sanitizer or quorum rule, and observe whether attack success drops as the mechanism predicts.

Watch

Extended reading notes

Core claim

The paper's central discovery is that adversarial vulnerability in multi-agent LLM pipelines is a structural property: a pipeline $G=(A,E)$ with unverified inter-agent boundaries has a high attack success rate no matter which model executes it. It formalizes three unverified boundary classes—content boundaries that fail to separate retrieved data from instructions, delegation boundaries that fail to bind declared plans to executed steps, and identity boundaries that infer agent identity from routing position instead of credentials—and derives four attack classes from 147 annotated production traces: prompt injection via retrieved content, consensus poisoning, plan hijacking or forced early termination, and silent agent substitution or Sybil attacks. In a controlled ten-agent, five-layer pipeline holding architecture fixed across GPT-5-mini, Claude Sonnet 4.5, and Kimi K2.5, all four attack classes succeed at rates above 0.6, recovery rates stay below 0.22, and the spread in attack success across models is narrow relative to the spread across attack types. The conclusion the authors draw is that the missing boundary checks are the dominant variable, and that pipeline-level enforcement—cryptographic attestation, quorum-based plan commitment, and out-of-band auditing—is the necessary defense.

Load-bearing premise

The argument rests on the assumption that once a pipeline lacks a verification check, the choice of model has no effect on whether an attack succeeds; the controlled experiments show small but nonzero model differences, so Equation (10)'s model-free form is assumed rather than demonstrated.

Editorial extensions

If this is right

  • Defensive investment should move from model-level safety tuning to pipeline-level mechanisms: cryptographic attestation for identity, quorum-based plan commitment, and out-of-band auditing for content partitioning.
  • Existing evaluation frameworks that score end-task correctness miss these failures; all 147 traced deployments received perfect security scores despite 452 errors matching the four attack classes.
  • Downstream review agents cannot be relied on as a safety net: recovery rates peak at 0.22 and fall below 0.10 under prompt injection and plan hijacking.
  • Payloads under content-boundary and delegation-boundary attacks traverse four to six hops before any intervention point, so the message-passing interface itself must carry provenance or attestation.
  • Swapping the backbone model for a more safety-tuned model will not by itself reduce attack success as long as the pipeline's boundary checks remain absent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's mechanism implies a direct testable extension: insert a single boundary verifier, such as a retrieval sanitizer or a quorum check, at one layer and measure whether attack success drops; the mechanism predicts a sharp drop while a model swap predicts none.
  • If the architectural claim transfers, agentic benchmarks should shift from task accuracy to boundary-check coverage, scoring pipelines on whether content, delegation, and identity constraints are enforced.
  • The trace-driven method suggests that auditing production traces for missing spans, fabricated citations, and skipped plan steps could serve as a low-cost vulnerability scanner for deployed multi-agent systems.
  • The formalization implies that adversarial robustness should be studied as a property of the communication graph and its edge checks, connecting this work to byzantine fault-tolerance analyses of agent networks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper argues that adversarial vulnerability in multi-agent LLM pipelines is an architectural property rather than a model-capability property. It introduces the concept of boundary verification across content, delegation, and identity boundaries, derives four attack classes from 147 annotated TRAIL traces, and evaluates them in a ten-agent, five-layer pipeline across GPT-5-mini, Claude Sonnet 4.5, and Kimi K2.5. The experiments report that attack success varies little across models but strongly across attack types, and the paper concludes that defenses should be deployed at the pipeline level. A formalization in Section V, Equation (10), defines attack success as a probability over messages and edges and claims that the right-hand side contains no model term, so attack success is a property of the pipeline graph alone.

Significance. If substantiated, the architectural-vulnerability claim would redirect defensive investment toward pipeline-level mechanisms such as attestation, quorum enforcement, and plan verification, and would complement model-level safety work. The paper's strengths are the trace-driven taxonomy grounded in TRAIL, the controlled multi-model evaluation with a shared pipeline configuration, and the public code repository. The empirical observation that three frontier models behave similarly in one pipeline configuration is useful. However, the central theoretical step in Equation (10) is not a valid derivation, and the empirical support is too thin to justify the strong 'fundamentally architectural' conclusion.

major comments (4)
  1. [Section V, Eq. (10)] The success probability S is defined as Pr_{m,(a_i,a_j)~G}[B_k(m,(a_i,a_j))=0], and the paper infers model-independence from the absence of M_LLM on the right-hand side. This is not a derivation: the messages m are sampled from the backbone model's conditional distribution given prompts, retrieved content, and prior agent outputs, so M_LLM enters through the sampling measure. Moreover, B_k=0 for content injection requires that the model actually obeys the injected directive; a model trained to ignore instructions embedded in retrieved data would yield lower S with the same missing boundary check. The observed spread of up to 0.07 in Figure 6a is direct counterevidence to the claim that swapping the model leaves S unchanged. The paper should either include the model term explicitly or downgrade this to an empirical observation bounded to the tested models.
  2. [Section IV.A, Figure 6] The success criteria are hand-chosen and differ across attacks: A1 requires propagation across at least 2 hops, A3 requires plan compliance below 0.5, and A2/A4 criteria are described only qualitatively as 'commits without verification' and 'accept and forward'. Because the headline comparison across attack types (0.25 spread versus 0.07 model spread) depends on these thresholds, the paper should justify the thresholds and show that the hierarchy is robust to reasonable variations, such as A1 at 1 or 3 hops or an A3 threshold of 0.4 or 0.6.
  3. [Section III] The trace analysis claims that all four vulnerability classes are present in benign deployments and that all 147 traces receive perfect security scores under the TRAIL rubric, but the mapping from the 836 error instances to the 452 class instances is not described in sufficient detail, and no inter-annotator agreement or precision numbers are reported. The claim that these vulnerabilities 'largely evade existing evaluation frameworks' rests on a single rubric and should be qualified accordingly.
  4. [Section IV.A / Figure 6] No confidence intervals or significance tests are reported for the success rates, accuracy drops, or recovery rates. With 20 shared tasks and 3 variants per attack, the 0.07 maximum model spread for A1 may be within sampling noise; the 'roughly fourfold ratio' between attack-type spread and model spread is not tested. Please report per-condition confidence intervals, for example via bootstrap, or a small statistical test to support the hierarchy.
minor comments (5)
  1. [Section II.A, Eq. (1)] The composition notation a_n ∘ ... ∘ a_1 is potentially confusing because evaluation is in topological order; please define the order explicitly.
  2. [Section III] The per-class trace counts (102, 78, 56, 77) sum to 313, while the text says the classes appear across 108 traces; clarify that traces can contain multiple classes and state the union count.
  3. [Figure 6] Add error bars or per-model sample sizes; the numerical labels in panel (a) are helpful, but panels (b)-(d) lack a clear legend for the model colors.
  4. [Section IV] The phrase 'not explicitly safety-tuned for agent-to-agent interaction' is an unsupported characterization of the three models; rephrase it as a stated assumption.
  5. [Section I] The claim of an 'empirical rather than synthetic approach' should be reconciled with the later controlled simulation; consider saying 'trace-grounded' instead.

Circularity Check

1 steps flagged · score 8.0 of 10

Equation (10) makes model-independence true by definition: the success probability samples messages '~G' with no model-dependent measure, so 'no M_LLM term' is a tautology, not a finding.

  1. self definitional [Section V, Equation (10) and following paragraph]
    "The attack succeeds whenever execution reaches a configuration in which the constraint fails, so S(G,MLLM,Ak)=Pr m,(ai,aj)∼G [Bk(m,(ai,aj))=0] (10). The right-hand side of Equation10contains no term involving MLLM. Attack success is a property of Galone, and swapping the baseline model leaves it unchanged."

    The probability in Equation (10) is defined as a distribution over messages m and edges (a_i,a_j) '~G', with no term for the model that generates m. In the actual pipeline, messages are sampled from the backbone model's conditional distribution given prompts, retrieved content, and prior agent outputs, so the correct success probability must include P_{M_LLM}(m | context). By omitting that measure, the paper builds model-independence into the definition of S and then concludes 'no term involving MLLM.' The formal claim that attack success is a property of G alone is therefore assumed by the construction of Equation (10), not derived from the experiments.

full rationale

The paper's central claim, that adversarial vulnerability is 'fundamentally an architectural property' and independent of the backbone model, rests on the formal step in Section V: Equation (10) defines S as a probability over messages and edges sampled '~G' and then observes that the right-hand side contains no M_LLM term. This is circular because the message distribution in a real multi-agent pipeline is generated by M_LLM; omitting that dependence from the probability measure makes model-independence true by construction. The empirical results showing a 0.07 model spread under A1 are acknowledged but then discounted, while the formal equation is treated as decisive. The trace-driven taxonomy (Section III) and the controlled evaluation (Section IV) are genuine empirical contributions and are not themselves circular; however, the load-bearing answer to RQ4 is forced by the definition in Equation (10). Because the derivation chain reduces its main conclusion to its own definitional setup, the appropriate circularity score is 8 rather than a lower value.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The central claim rests on several assumptions and hand-set success thresholds. The thresholds directly define the reported success rates. The axioms include the trace-to-adversary transfer assumption, the exhaustiveness of the three boundary classes, the impossibility of self-verification, and the decisive assumption in Equation (10) that model behavior can be omitted from attack success. No new physical entities are needed; the 'boundary verification' primitive is a proposed design concept, not an empirically validated artifact.

free parameters (3)
  • A1 success threshold (propagation distance) = at least 2 hops
    Hand-set criterion for whether prompt injection succeeds; it directly controls A1 success rates.
  • A3 success threshold (plan compliance) = below 0.5
    Hand-set cutoff for plan hijacking; changing it would change the reported A3 success rates.
  • A2 and A4 success criteria = unquantified (commits without verification; downstream accepts)
    These success definitions are qualitative and are not scored by an independent rubric.
assumptions (4)
  • domain assumption Failure modes observed in benign production traces represent latent adversarial vulnerabilities that an adversary can reliably trigger.
    Section III states this as the core assumption; it is plausible but unproven and load-bearing for the trace-derived taxonomy.
  • ad hoc to paper Attack success probability is fully determined by the absence of boundary checks, so the model term can be omitted (Equation 10).
    Equation (10) defines S without M_LLM and is then used to prove model independence; this is an assumption introduced for this paper, not a theorem.
  • domain assumption The three boundary classes (content, delegation, identity) exhaust the relevant attack surface in multi-agent pipelines.
    Section II-B presents them as collectively constituting the implicit trust assumption; other surfaces, such as memory and state integrity, are mentioned but not formally in the model.
  • domain assumption An LLM cannot verify boundary constraints on itself because the checks operate on inter-agent messages.
    Section V asserts this; it motivates the shift to external verification but is not empirically demonstrated.
invented entities (1)
  • Boundary verification as a security primitive
    purpose: A proposed primitive requiring explicit validation of content, identity, execution intent, and state integrity at inter-agent boundaries.
    The paper defines this concept and uses it as the central explanatory device, but provides no implementation or independent falsifiable handle beyond the described attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures." pith.science (2026). https://pith.science/paper/USHXSJOU

@misc{pith2026260800718,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/USHXSJOU}},
  note         = {Machine review of arXiv:2608.00718}
}
read the original abstract

Multi-agent LLM pipelines orchestrate multiple specialized language model agents into structured workflows where intermediate outputs are passed across agents to solve complex tasks. This design introduces a security gap absent in single-agent settings: once an agent accepts adversarial content, it is propagated as trusted input throughout the pipeline. We argue that this vulnerability stems from the absence of boundary verification, a security primitive that enforces explicit validation of data as it crosses inter-agent boundaries, including content, identity, execution intent, and state integrity. Without such verification, modern pipelines embed implicit trust assumptions that are not adversarially robust, giving rise to structurally distinct attack surfaces (e.g., content injection, agent impersonation, plan deviation, and memory poisoning). Leveraging annotated production traces from the GAIA and SWE-Bench benchmark, we show that these vulnerabilities arise in benign deployments and largely evade existing evaluation frameworks. We further operationalize these failure modes within a controlled multi-agent setting and evaluate them across GPT-5-mini, Claude Sonnet 4.5, and Kimi K2.5 under identical pipeline configurations. The results reveal that attack success aligns with pipeline structure rather than model capability, indicating that adversarial vulnerability is fundamentally an architectural property and motivating a shift toward pipeline-level defenses.

Figures

Figures reproduced from arXiv: 2608.00718 by the authors.

Figure 2
Figure 2. A2: the orchestrator accepts any single sub-agent result without quorum, allowing one compromised agent to control the final output. Trace evidence. We identify this failure pattern in 78 traces (53.1%, 110 instances), with 97.3% rated HIGH-impact. In trace 5e5dc94e, the orchestrator planned four retrieval steps but called final_answer at Step 2 without executing any of them, stating “I know from the literature. . .… view at source ↗
Figure 1
Figure 1. A1: adversarial content in retrieved pages overrides task directives with no sanitization boundary between data and instruction context. Trace evidence. This is the most frequent vulnerability, found in 102 of 147 traces (69.4%, 154 instances). In trace 5a6c51d5, the agent’s output claims “In our internal in￾vestigation (using our search agent) we have found that. . . ” yet no ToolCallingAgent.run span exists in the… view at source ↗
Figure 3
Figure 3. A3: the plan has no enforcement; any trigger signal causes the orchestrator to skip remaining steps and terminate prematurely. Trace evidence. We detect this behavior in 56 traces (38.1%, 57 instances), with a near one-to-one instance-to-trace ratio. In trace 4a8d094e, after a failed Step 1 search the agent concluded “the compound is ‘diamond’ ” with no retrieval performed. Steps 2 through 6 of the declared plan hav… view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Five-layer multi-agent system architecture. [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]
Figure 4
Figure 4. Figure 4: A4: agent identity is inferred from span position alone. A forged span at the correct position is indistinguishable from a legitimate agent output. Trace evidence. We found this phenomenon in 77 traces (52.4%, 131 instances), with higher concentration in SWE￾Bench (83.…
Figure 6
Figure 6. Figure 6: Adversarial evaluation results across four attack types and three backbone models. [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 13 canonical work pages

  1. [1]

    A survey on large language model based autonomous agents,

    L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y . Linet al., “A survey on large language model based autonomous agents,”Frontiers of Computer Science, vol. 18, no. 6, p. 186345, 2024

    2024

  2. [2]

    Autogen: Enabling next-gen llm applications via multi-agent conversations,

    Q. Wu, G. Bansal, J. Zhang, Y . Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liuet al., “Autogen: Enabling next-gen llm applications via multi-agent conversations,” inFirst conference on language modeling, 2024

    2024

  3. [3]

    Langchain,

    LangChain, “Langchain,” 2023, accessed: 2026-04-27. [Online]. Available: https://github.com/langchain-ai/langchain

    work page 2023

  4. [4]

    Gaia: a benchmark for general ai assistants,

    G. Mialon, C. Fourrier, T. Wolf, Y . LeCun, and T. Scialom, “Gaia: a benchmark for general ai assistants,” inThe Twelfth International Conference on Learning Representations, 2023

    2023

  5. [5]

    Swe-bench: Can language models resolve real-world github issues?

    C. E. Jimenez, J. Yang, A. Wettig, S. Yao, K. Pei, O. Press, and K. Narasimhan, “Swe-bench: Can language models resolve real-world github issues?”arXiv preprint arXiv:2310.06770, 2023

    arXiv 2023

  6. [6]

    Agent smith: a single image can jailbreak one million multimodal llm agents exponentially fast,

    X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y . Wang, J. Jiang, and M. Lin, “Agent smith: a single image can jailbreak one million multimodal llm agents exponentially fast,” inProceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024

    work page 2024

  7. [7]

    Prompt infection: Llm-to-llm prompt injection within multi-agent systems,

    D. Lee and M. Tiwari, “Prompt infection: Llm-to-llm prompt injection within multi-agent systems,”arXiv preprint arXiv:2410.07283, 2024

    arXiv 2024

  8. [8]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” inProceedings of the 16th ACM workshop on artificial intelligence and security, 2023, pp. 79–90

    work page 2023

Show all 29 references
  1. [9]

    {PoisonedRAG}: Knowledge corruption attacks to{Retrieval-Augmented}generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “{PoisonedRAG}: Knowledge corruption attacks to{Retrieval-Augmented}generation of large language models,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 3827–3844

    2025

  2. [10]

    The dark side of llms: Agent-based attacks for complete computer takeover,

    M. Lupinacci, F. A. Pironti, F. Blefari, F. Romeo, L. Arena, and A. Fur- faro, “The dark side of llms: Agent-based attacks for complete computer takeover,”arXiv preprint arXiv:2507.06850, 2025

    2025 arXiv

  3. [11]

    Trism for agentic ai: A review of trust, risk, and security management in llm-based agentic multi-agent systems,

    S. Raza, R. Sapkota, M. Karkee, and C. Emmanouilidis, “Trism for agentic ai: A review of trust, risk, and security management in llm-based agentic multi-agent systems,”AI Open, 2026

    2026

  4. [12]

    Open challenges in multi-agent security: Towards secure systems of interacting ai agents,

    C. S. de Witt, “Open challenges in multi-agent security: Towards secure systems of interacting ai agents,”arXiv preprint arXiv:2505.02077, 2025

    2025 arXiv

  5. [13]

    Ai agents under threat: A survey of key security challenges and future pathways,

    Z. Deng, Y . Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y . Xiang, “Ai agents under threat: A survey of key security challenges and future pathways,”ACM Computing Surveys, vol. 57, no. 7, pp. 1–36, 2025

    2025

  6. [14]

    The emerged security and privacy of llm agent: A survey with case studies,

    F. He, T. Zhu, D. Ye, B. Liu, W. Zhou, and P. S. Yu, “The emerged security and privacy of llm agent: A survey with case studies,”ACM Computing Surveys, vol. 58, no. 6, pp. 1–36, 2025

    2025

  7. [15]

    Formalizing and benchmarking prompt injection attacks and defenses,

    Y . Liu, Y . Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and benchmarking prompt injection attacks and defenses,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 1831–1847

    2024

  8. [16]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tram `er, “Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,”Advances in Neural Information Processing Systems, vol. 37, pp. 82 895–82 920, 2024

    2024

  9. [17]

    Agent security bench (asb): Formalizing and benchmarking at- tacks and defenses in llm-based agents,

    H. Zhang, J. Huang, K. Mei, Y . Yao, Z. Wang, C. Zhan, H. Wang, and Y . Zhang, “Agent security bench (asb): Formalizing and benchmarking at- tacks and defenses in llm-based agents,”arXiv preprint arXiv:2410.02644, 2024

    2024 arXiv

  10. [18]

    Trail: Trace reasoning and agentic issue localization,

    D. Deshpande, V . Gangal, H. Mehta, J. Krishnan, A. Kannappan, and R. Qian, “Trail: Trace reasoning and agentic issue localization,” 2025. [Online]. Available: https://arxiv.org/abs/2505.08638

    2025 arXiv

  11. [19]

    Gpt-5 mini,

    OpenAI, “Gpt-5 mini,” 2025, accessed 2026-05-03. [Online]. Available: https://platform.openai.com/docs/models/gpt-5-mini/

    2025

  12. [20]

    Claude sonnet 4.5,

    Anthropic, “Claude sonnet 4.5,” 2025, accessed 2026-05-03. [Online]. Available: https://www.anthropic.com/news/claude-sonnet-4-5

    2025

  13. [21]

    Kimi k2.5,

    Moonshot AI, “Kimi k2.5,” 2025, accessed 2026-05-03. [Online]. Available: https://github.com/MoonshotAI/Kimi-K2.5

    2025

  14. [22]

    Practical byzantine fault tolerance,

    M. Castro, B. Liskovet al., “Practical byzantine fault tolerance,” inOsDI, no. 1999, 1999, pp. 173–186

    1999

  15. [23]

    Audit-llm: Multi-agent collaboration for log-based insider threat detection,

    C. Song, L. Ma, J. Zheng, J. Liao, H. Kuang, and L. Yang, “Audit-llm: Multi-agent collaboration for log-based insider threat detection,”arXiv preprint arXiv:2408.08902, 2024

    2024 arXiv

  16. [24]

    Flooding spread of manipulated knowledge in llm-based multi-agent communities,

    T. Ju, Y . Wang, X. Ma, P. Cheng, H. Zhao, Y . Wang, L. Liu, J. Xie, Z. Zhang, and G. Liu, “Flooding spread of manipulated knowledge in llm-based multi-agent communities,”arXiv preprint arXiv:2407.07791, 2024

    2024 arXiv

  17. [25]

    Secret collusion among ai agents: Multi- agent deception via steganography,

    S. R. Motwani, M. Baranchuk, M. Strohmeier, V . Bolina, P. H. Torr, L. Hammond, and C. S. de Witt, “Secret collusion among ai agents: Multi- agent deception via steganography,”Advances in Neural Information Processing Systems, vol. 37, pp. 73 439–73 486, 2024

    2024

  18. [26]

    Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,

    R. Shahroz, Z. Tan, S. Yun, C. Fleming, and T. Chen, “Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 9661– 9674

    2025

  19. [27]

    Psysafe: A comprehensive framework for psychological- based attack, defense, and evaluation of multi-agent system safety,

    Z. Zhang, Y . Zhang, L. Li, J. Shao, H. Gao, Y . Qiao, L. Wang, H. Lu, and F. Zhao, “Psysafe: A comprehensive framework for psychological- based attack, defense, and evaluation of multi-agent system safety,” inProceedings of the 62nd Annual Meeting of the Association for Compu...

    2024

  20. [28]

    Autodefense: Multi-agent llm defense against jailbreak attacks,

    Y . Zeng, Y . Wu, X. Zhang, H. Wang, and Q. Wu, “Autodefense: Multi-agent llm defense against jailbreak attacks,”arXiv preprint arXiv:2403.04783, 2024

    2024 arXiv

  21. [29]

    The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections,

    M. Nasr, N. Carlini, C. Sitawarin, S. V . Schulhoff, J. Hayes, M. Ilie, J. Pluto, S. Song, H. Chaudhari, I. Shumailovet al., “The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections,”arXiv preprint arXiv:2510.09023, 2025

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.