Search papers, labs, and topics across Lattice.
This paper introduces the Game-Theoretic Secure Model Context Protocol (GT-MCP), a novel multi-agent framework that enhances the robustness of large language models (LLMs) against context-poisoning attacks by treating context management as a closed-loop dynamical process. By coordinating three heterogeneous LLM agents and employing a trust function to evaluate causal consistency and semantic agreement, GT-MCP effectively maintains contextual stability across multi-turn interactions. Empirical results demonstrate that GT-MCP bounds contextual drift in 99.6% of turns and achieves a high success rate in preventing adversarial injections, while maintaining low computational overhead.
Contextual drift in LLMs can be contained with over 99% effectiveness, drastically reducing the risk of adversarial manipulation in multi-turn interactions.
Large Language Models (LLMs) in multi-turn interactions maintain evolving context rather than generating isolated responses, making them vulnerable to prompt-injection and context-poisoning attacks in which locally plausible adversarial fragments gradually distort reasoning trajectories. Existing defenses mainly filter individual outputs and often ignore context evolution across turns, leaving long-horizon reasoning exposed. Although the Model Context Protocol (MCP) standardizes context exchange and tool invocation, it functions as a passive routing layer and does not enforce contextual stability. To address these limitations, we introduce the Game-Theoretic Secure Model Context Protocol (GT-MCP), a controller-driven multi-agent method that treats context management as a closed-loop dynamical process. GT-MCP coordinates three heterogeneous LLM agents and selects outputs through a trust function that jointly evaluates causal consistency against a validated context graph, semantic agreement among agents, and distributional drift over time. When instability is detected, a rollback-based self-healing mechanism restores the validated context and prevents unsupported fragments from propagating. Empirical evaluation over 500 interaction turns under an adaptive adversarial threat model shows that contextual drift remains bounded in 99.6% of turns, with recovery required in only 0.4%. Per-turn utility remains tightly concentrated, with median = -0.19, P05 = -0.72, and P95 = 0.30; severe degradation below -1 occurs in only 0.4% of cases, and no injection attempt succeeds at the controller level. Selected outputs maintain stable win rates above 98%, and computational overhead remains predictable, with latency per token = 1.63e-3 s.
