DynaTrust: Defending Multi-Agent Systems Against Sleeper Agents via Dynamic Trust Graphs

Yu Li; Qiang Hu; Yao Zhang; Lili Quan; Jiongchi Yu; Junjie Wang

cs.AIMar 9, 2026

DynaTrust: Defending Multi-Agent Systems Against Sleeper Agents via Dynamic Trust Graphs

Authors: Yu Li, Qiang Hu, Yao Zhang, Lili Quan, Jiongchi Yu, Junjie Wang

Organizations: Tianjin University · Singapore Management University

Abstract

Large Language Model-based Multi-Agent Systems (MAS) have demonstrated remarkable collaborative reasoning capabilities but introduce new attack surfaces, such as the sleeper agent, which behave benignly during routine operation and gradually accumulate trust, only revealing malicious behaviors when specific conditions or triggers are met. Existing defense works primarily focus on static graph optimization or hierarchical data management, often failing to adapt to evolving adversarial strategies or suffering from high false-positive rates (FPR) due to rigid blocking policies. To address this, we propose DynaTrust, a novel defense method against sleeper agents. DynaTrust models MAS as a dynamic trust graph~(DTG), and treats trust as a continuous, evolving process rather than a static attribute. It dynamically updates the trust of each agent based on its historical behaviors and the confidence of selected expert agents. Instead of simply blocking, DynaTrust autonomously restructures the graph to isolate compromised agents and restore task connectivity to ensure the usability of MAS. To assess the effectiveness of DynaTrust, we evaluate it on mixed benchmarks derived from AdvBench and HumanEval. The results demonstrate that DynaTrust outperforms the state-of-the-art method AgentShield by increasing the defense success rate by 41.7%, achieving rates exceeding 86% under adversarial conditions. Furthermore, it effectively balances security with utility by significantly reducing FPR, ensuring uninterrupted system operations through graph adaptation.

Figures & tables

Figure 1: The attack and DynaTrust defense models of MAS.

Figure 3: The DSR of DynaTrust versus AgentShield across diverse multi-agent frameworks and LLM backends.

Method	DSR ( $\uparrow$ )	TSR ( $\uparrow$ )	FPR ( $\downarrow$ )
No Defense	0.0%	85.4%	–
Zero-Trust	94.8%	66.5%	15.3%
DynaTrust	92.4%	84.9%	2.2%

Table 1: Average Defense Effectiveness. Results are averaged across 4 MAS frameworks driven by 5 LLMs. DynaTrust maintains high utility (TSR) comparable to the baseline while significantly reducing FPR.

Framework	Backend	w/ Auditor			w/ Consensus			w/o Trust Evolution			DynaTrust
		DSR (%)	FPR (%)	SSR (%)	DSR (%)	FPR (%)	SSR (%)	DSR (%)	FPR (%)	SSR (%)	DSR (%)	FPR (%)	SSR (%)
CAMEL	gpt-4o	7.52	1.54	0.00	45.25	12.56	8.26	82.15	5.40	7.68	91.43	2.20	7.41
	gpt-4o-mini	6.90	0.00	0.00	42.11	14.22	6.70	79.59	6.15	5.29	86.82	1.54	5.95
	gpt-3.5-turbo	5.85	0.00	0.00	38.50	15.82	6.34	75.44	7.22	5.25	96.40	2.93	5.49
	gemini-2.5-flash	6.33	1.50	0.00	44.65	13.10	6.48	80.29	5.82	4.28	95.15	1.30	6.21
	deepseek-v3	8.26	2.20	0.00	46.89	11.53	7.98	81.57	4.97	9.20	86.28	1.50	8.37

Table 2: Ablation Study of DynaTrust: Comparison of DSR, FPR and SSR across different MAS frameworks and LLM backbones. w/ Auditor : Only local fast auditor. w/ Consensus : Only consensus. w/o Trust Evolution : DynaTrust only without Trust Evolution. DynaTrust : Full components.

Figure 4: Trust score evolution illustrating the system’s response to a mixed workload of 100 turns, including 20 persistent adversarial attacks. The curve shows how trust evolution preserves utility during the early attack phases, and how the graph recovery mechanism (at Turn 69) restores normal operation following agent failure.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Jul 7, 2026

When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems

While enabling effective collaboration on complex tasks, LLM-based Multi-Agent Systems (MAS) face critical security challenges due to vulnerabilities at the agent and interaction levels. Most existing MAS security defenses are built upon two core assumptions: semantically-explicit malicious attacks and explicit graph-based modeling of the MAS topology and agent-level interactions. In practice, real-world attacks are becoming more semantically stealthy, while MAS execution is typically asynchronous without the temporal alignment assumed by graph-based propagation models. To address these limitations, we propose AcMAS, an activation-based framework for malicious-behavior detection in MAS. By analyzing internal reasoning states in the activation space of local agents, AcMAS detects even stealthy attacks in a synchronization-robust fashion, without relying on explicit interaction graphs. Moreover, our activation analysis provides critical signals to guide AcMAS in restoring the functionality of compromised agents, rather than the disruptive agent isolation commonly used by the state-of-the-art methods. Comprehensive evaluation demonstrates that AcMAS significantly outperforms graph-based baselines against stealthy attacks, by +0.22 F1 in synchronous settings (0.94 vs. 0.72) and by +0.55 F1 in asynchronous settings (0.93 vs. 0.38), with generalization across diverse open-source LLM backbones, attack intensity, and MAS scale.

Haowen Xu, Xue Tan, Lei Ma +6

Department of Computer Science, Worcester Polytechnic Institute, MA, USA · School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China +1

LLM Agent Security AI Agent Monitoring Multi-Agent System Security Anomaly Detection

Ask PDF

Nov 28, 2025

MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS

Large Language Model (LLM)-based Multi-Agent Systems (MAS) are susceptible to linguistic attacks that can trigger cascading failures across the network. Existing defenses face a fundamental dilemma: lightweight single-auditor methods are prone to single points of failure, while robust committee-based approaches incur prohibitive computational costs in multi-turn interactions. To address this challenge, we propose MAS-Shield, a secure and efficient defense framework designed with a coarse-to-fine filtering pipeline. Rather than applying uniform scrutiny, MAS-Shield dynamically allocates defense resources through a three-stage protocol: (1) Critical Agent Selection strategically targets high-influence nodes to narrow the defense surface; (2) Light Auditing employs lightweight sentry models to rapidly filter the majority of benign cases; and (3) Global Consensus Auditing escalates only suspicious or ambiguous signals to a heavyweight committee for definitive arbitration. This hierarchical design effectively optimizes the security-efficiency trade-off. Experiments demonstrate that MAS-Shield achieves a 92.5% recovery rate against diverse adversarial scenarios and reduces defense latency by over 70% compared to existing methods.

Kaixiang Wang, Zhaojiacheng Zhou, Bunyod Suvonov +8

Department of Computer Science and Engineering Shanghai Jiao Tong University Shanghai 200240, China

Multi-Agent LLM Systems LLM Auditing LLM Agent Security Multi-Agent System Security

Ask PDF

May 27, 2026

Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification

Recent years have witnessed the rapid development of Large Language Model-based Multi-Agent Systems (MAS), which excel at collaborative decision-making and complex problem-solving. However, malicious agents in MAS may inject misinformation to mislead other agents and disrupt system performance, giving rise to a new research direction that focuses on attack mechanisms and defense strategies in MAS. Prior studies largely assume malicious agents act independently and investigate the corresponding defense strategies. However, we argue that malicious agents may exhibit collaborative behaviors, enabling more effective attacks through internal information exchange. In this paper, we propose an adaptive cooperative attack framework, where malicious agents autonomously coordinate and dynamically adjust their attack strategies through multi-round interactions. Furthermore, we introduce Sentence-Level Trustworthiness Analysis and Rectification (STAR), a defense framework that identifies and rectifies misleading information at the sentence level within agent communications. Our experiments show that cooperative attacks lead to a significantly larger degradation in task success rate than independent attacks, resulting in a relative drop of 5.34%. Meanwhile, STAR effectively mitigates both cooperative and independent threats and improves task success rate by an average of 36.76%. The code is available at https://github.com/smoooom/STAR.

Yaoyang Luo, Zhi Zheng, Ziwei Zhao +5

University of Science and Technology of China · North Automatic Control Technology Institute · Shenzhen Institute for Advanced Study, UESTC

Multi-Agent LLM Systems Fake News Detection Adversarial Robustness Multi-Agent System Security Multi-Agent Communication

Ask PDF

Abstract

AI Agent Security

Explore similar work

When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems

MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS

Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification