Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers
Filter4

Attack type

Prompt injection4

Impact

Harmful content4Unauthorized actions8Data and privacy leaks6Output manipulation11

System type

AI Agent11Multi-agent systems10

Attack surface / entry point

User input24Web pages and interfaces16Documents and messages25Tool responses16Tool and skill descriptions5Code repositories and dependencies5Retrieval corpus26Memory writes7Inter-agent messages10Images, audio and video4Training data1Distribution channels9

Layer

Model layer5Application layer11Training and data layer24
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Impact：Output manipulationAttack surface / entry point：Inter-agent messagesAttack surface / entry point：Training dataLayer：Application layerClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.02349

    MIRROR：面向多智能体通信的法定人数完整性防御

    提出 MIRROR，用多路径摘要多数表决保障多智能体通信完整性

    arXiv
    2610.02349
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Gemma-4-31B-it, Gemini 2.5 Pro
    AbstractMIRROR 靠多数路径。

    MIRROR 是 LLM 多智能体通信层上的多路径法定人数完整性原语，只处理不透明字节，不解释消息内容。要处理的是 Agent-in-the-Middle：中介合法终结 TLS 后可改在途消息，而语义校验有推理开销和误拦，签名又要求私钥管理。做法是生成结束后复制同一规范化载荷。

    Paper analysisRead analysis
  2. DefensesarXiv 2610.02005

    贝叶斯辩证论证（BDA）：面向持续对抗下多 LLM 委员会的可校准聚合

    提出 BDA，按辩证动作可靠性加权聚合多 LLM 议会以抵抗持续对抗

    arXiv
    2610.02005
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    AbstractBDA 用零额外调用的可靠性加权，给出可校准后验，并在持续对抗下反转不可靠席位。

    BDA 是一种不另调 LLM 的多 LLM 议会聚合方法，同时处理置信度校准和持续不可靠席位。

    Paper analysisRead analysis
  3. DefensesarXiv 2609.39297

    MiniRep：面向多智能体辩论的鲁棒声誉聚合方法

    提出 MiniRep，在多智能体辩论聚合中结合当前质量、风险与历史声誉并限制克隆组

    arXiv
    2609.39297
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    AbstractMiniRep 用当前提案证据校准历史声誉并限制克隆组，MATH 上平均准确率高于基线，其他任务有反例。

    MiniRep 是面向恶意智能体的 MAD 声誉聚合，只作用在 Decide 阶段。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.17817

    论文：用投毒基准污染自改进编码 Agent，令其后续版本写出漏洞代码

    提出基准投毒攻击，使自修改编码 Agent 跨代写出含漏洞代码

    arXiv
    2609.17817
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.5, Qwen3.5-397B, gpt-oss-120b and others5

    Abstract论文报告了恶意基准能污染自修改代码智能体的进化过程并持续输出漏洞，警示系统设计需纳入安全约束。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2609.17320

    Emergence World：对长时程多智能体系统开展对抗压力测试

    提出 Emergence World，对长时程多智能体系统开展对抗压力测试

    arXiv
    2609.17320
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Claude Opus 4.8, DeepSeek v4 Pro, Gemini 3.5 Flash and others9

    Abstract作者通过长期平行世界实验指出模型对齐不具备可组合性，单模型群体会产生社会奉承、协同退缩及语言不透明等失效。

    Paper analysisRead analysis
  6. OtherarXiv 2608.30387

    研究者提出多智能体系统输出与委派链路双层存证方案

    提出多智能体输出与跨部署方委派的两层存证

    arXiv
    2608.30387
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Abstract两层证明记录放出字节与边授权。

    部署方侧的两层证明，用来在多智能体跨部署方委托之后回答两个事后问题：谁放出了这些字节，这条跨部署方边有没有父方授权。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2608.03272

    多智能体协同过滤系统的连接性攻击与防御研究

    复现 AgentCF 上的多智能体攻防并刻画连通性作用

    arXiv
    2608.03272
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B, Claude Haiku 4.5, Mixtral 8×7B and others4
    Abstract连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。

    作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。

    Paper analysisRead analysis
  8. AttacksarXiv 2608.00718

    研究揭示多智能体 LLM 流水线的结构性漏洞

    提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播

    arXiv
    2608.00718
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-5-mini, Claude Sonnet 4.5, Kimi K2.5
    Abstract缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。

    作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。

    Paper analysisRead analysis
  9. AttacksarXiv 2603.20925

    Profit is the Red Team: Stress-Testing Agents in Strategic Economic Interactions

    提出利润驱动红队，用标量盈余搜索对手以压测经济博弈 Agent

    arXiv
    2603.20925
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-OSS-120B, Qwen3-32B, MiniMax-M2.5 and others6
    Abstract利润驱动红队以标量盈余训练对手，六个目标在四博弈中被利用，提示规则可抬高目标盈余。

    利润驱动红队把可审计终局里的智能体安全写成对手搜索问题：固定目标会不会被一个只追逐自身盈余的自适应玩家利用。

    Paper analysisRead analysis
  10. DefensesarXiv 2603.04474

    From Spark to Wildfire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration

    Proposing a lineage-graph governance layer to suppress error cascades in multi-agent collaboration

    arXiv
    2603.04474
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    AbstractA single seed can solidify into a false consensus along a fixed collaboration graph.

    The authors turn "small errors becoming collective false consensus" in LLM-MAS into a measurable propagation on a graph, and use a plug-in that only changes messages, not topology, to reduce the final infection.

    Paper analysisRead analysis
  11. AttacksarXiv 2603.00131

    Thought Virus：多 Agent 系统中潜意识提示引发的病毒式失准

    提出 Thought Virus，经潜意识提示使偏好沿多 Agent 消息传播

    arXiv
    2603.00131
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct
    AbstractThought Virus 把单点偏差传到下游。

    Thought Virus 把 subliminal prompting 放进多智能体通信，看单点偏差会不会在不点名目标概念时传到全网。

    Paper analysisRead analysis
You have reached the end