MAS-Guard: Unified Guardrails from Single Agents to Multi-Agent LLM Systems
MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems
Translation in progress — untranslated text is omitted.
The researchers propose MAS-Guard, a unified guardrail framework for single-agent and multi-agent LLM applications that can cover both instrumentable and opaque agents. Within instrumentable agents, a local Agent Guardrail (A-Guard) layer uses task-specific experts to evaluate agent events; the system layer consists of developer-defined Agent Charters and a control plane, performing deterministic structural checks on routing, agent capabilities, and message formats, and semantic evaluation of roles and message content. The two layers enforce through four interventions: allow, reflection, confirmation, and block. On six benchmarks covering single- and multi-agent scenarios and agent LLMs from three different providers, MAS-Guard reduces the overall attack success rate by 71.5-86.3% relative to agents without guardrails, and meets utility reference standards on benign tasks.
- Once agents connect retrieval, tools, and collaboration into execution, unsafe actions, leakage, and adversarial manipulation spread along tool results and inter-agent messages. When instrumentable and opaque agents are co-deployed, the authors argue that existing defenses are separate in surface, scope, and enforcement.
- MAS-Guard runs both local A-Guard experts and developer-written Agent Charter and Control Plane on the observable boundary. What can be judged by code goes through routing, format and capability checks; roles and content go through semantic evaluation, then are mapped to ALLOW, REFLECTION, CONFIRMATION, BLOCK.
- On GPT-5.6-Terra, Muse-Glimmer-30B, Grok-4.3 and six benchmarks, the authors report that overall ASR decreases by 71.5%–86.3% relative to no guardrails, and all three agents reach the benign utility reference. Per benchmark, it is not lowest everywhere: FIDES has lower ASR on ACIArena and AgentLeak, but its overall utility is below the reference.
- The authors assume the orchestration layer is trusted and instrumentable; opaque agents' internal actions and side effects that have already occurred are not covered by protection, and channels that bypass interception are not in the threat model. A charter that is too broad or too strict causes problems. Utility is measured only on benign turns, and legitimate task completion under attack is left for future work.
Related events and news
2 events · 1 news mentions
- This event's paper
研究者提出MAS-Guard统一护栏框架
News that mentions this paper
大模型安全周报：防线开始溃于组合，智能体授权与审计系统性缺口
- 公众号 大模型安全研究cites the paper's id or link大模型安全周报：防线开始溃于组合，智能体授权与审计的系统性缺口
MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems（https://arxiv.org/abs/2610.28397）
Related papers
- DEFER1DefensesarXiv