Auditable Belief Updates: The Missing Safety Layer in LLM-Driven Multi-Agent Systems
Auditable Belief Updates as a Missing Safety Layer for LLM-Powered Multi-Agent Systems
Translation in progress — untranslated text is omitted.
The paper proposes the EB-MAS framework, which externalizes agent belief states into structured carriers, adding an auditable belief-update safety layer to LLM-driven multi-agent systems. The framework uses belief operators to propose candidate updates, and a Cognitive Firewall to restrict or reject updates that are weakly evidenced and driven mainly by vulnerability cues. The authors also discuss group belief risks such as manufactured consensus, collusion, and misinformation cascades, arguing that scalable agent safety requires explicit interfaces for tracking, calibrating, and constraining belief revision at runtime.
- The safety risks of LLM multi-agent systems come not only from harmful outputs but also from how beliefs are updated and propagated across retrieval, memory, tools, and peer communication; existing frameworks lack auditable belief representations and update mechanisms, which the authors call the cognitive safety gap.
- Proposes EB-MAS: externalizing belief states with a five-tuple belief graph, with an LLM acting as a neuro-symbolic operator to propose candidate updates, then a cognitive firewall intercepting or capping them based on evidence–vulnerability mismatch; the population layer uses a consensus validity gate to modulate the influence of the social prior.
- Prototype evaluation: on MM-DeceptionBench, Qwen3-VL-32B direct answering has an unsafe rate of 67.92%, while EB-MAS reduces it to 8.19% with 1.00% benign false blocks; on 400 ASB tool/memory attacks, the attack pass rate drops from 6.50% to 0.00%; in the four-round evaluation, full EB-MAS has 0/240 unsafe submissions.
- The authors state the results are preliminary evidence: sandbagging remains the hardest category, provenance cues in ASB are relatively strong, and this cannot be regarded as solving open-world agent safety; only two models were tested, Qwen3-VL-32B-Instruct and GPT-4o-mini, and adaptive attacks were not tested.
Related events and news
1 events · 0 news mentions
- This event's paper
提出EB-MAS用认知防火墙约束多智能体信念更新
Related papers
- DEFER1DefensesarXiv