Search papers, labs, and topics across Lattice.
This paper conducts a comprehensive analysis of the security vulnerabilities inherent in multi-agent LLM systems (MAS) by examining 197 works across various interaction interfaces and adversary positions. The authors introduce an A-I-R framework that categorizes attacks based on adversary position, interaction interface, and resulting system-level risk, while also proposing a five-part contract for defense strategies. Key findings highlight the importance of path closure and recovery as critical challenges in ensuring MAS security, advocating for an interaction-aware perspective to effectively trace and mitigate attacks.
Multi-agent LLM systems are more vulnerable than previously thought, with systemic failures that local checks can't catch, demanding a new framework for security analysis.
Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely multi-agent security effect. We thus systematize MAS security through an execution-centered analysis of 197 works, covering six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS. We organize defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identify path closure and recovery as key challenges. We audit 44 evaluation and benchmark works and identify open challenges in isolating interaction effects, designing comparable and diagnostic metrics, supporting reuse across MAS designs, and evaluating open-system operation. Together, these findings motivate an interaction-aware view of MAS security: trace attacks end to end, test whether defenses close those paths, and evaluate system-level effects with appropriate counterfactuals.
