MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication

Ryuichi Yamafuji Lun; Jingzhen Wang; Shreyas Kolte; Ruiteng Li

cs.CROct 1, 2026

MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication

Authors: Ryuichi Yamafuji Lun, Jingzhen Wang, Shreyas Kolte, Ruiteng Li

Organizations: University of Southern California

Abstract

Inter-agent communication is central to Large Language Model Multi-Agent Systems (LLM-MAS), but it introduces an underexplored vulnerability: Agent-in-the-Middle (AiTM) attacks that manipulate messages in transit without compromising the agents themselves. Prior work reports Attack Success Rates (ASR) approaching 100% on structured tasks. Existing defenses rely on semantic validation, which requires additional inference and can block benign outputs, or on transport-layer encryption, which does not help when an intermediary legitimately terminates TLS. We present MIRROR, a communication-layer integrity primitive that replicates a single canonicalized payload across k logical routes and accepts a message only when a strict majority of routes report the same digest. MIRROR uses unkeyed hashing and so authenticates nothing on its own, since an active on-path adversary can always recompute a digest over a payload it has modified. All integrity derives from the assumption that honest routes form a majority. The digest serves only to make witness routes constant-size and to bind the recovered payload to the quorum-agreed value under second-preimage resistance. We give the guarantee under a route-compromise bound alpha < 0.5, and extend it to correlated routes, where the quantity that matters is the size of the largest shared-failure group and not the route count. We further show that availability and integrity degrade at the same threshold: below alpha = 0.5, quorum-denial and message-dropping adversaries cannot block honest traffic. Across MMLU, HumanEval, and MBPP on two frameworks and four communication topologies, and in a MetaGPT deployment against a production API, MIRROR reduces ASR to 0% below the threshold at 1x LLM token cost. LLM-as-a-Judge costs 35x in the same deployment, and blocks up to 44.2% of benign outputs in the topology sweep.

Figures & tables

Figure 1: Overview of communication threats and the MIRROR defense. (A) Traditional attacks originate from a malicious or compromised sender, which is outside MIRROR’s scope. (B) AiTM attacks manipulate messages in transit via a third-party interceptor. (C) MIRROR replicates across routes and verifies quorum, recovering valid messages or blocking corrupted transmissions.

	Classical BFT	MIRROR
Faulty component	Replica nodes	Network intermediaries
Agreement over	Program state / outputs	Message bytes
Rounds	Multi-round	Single-shot
Requires determinism of	Replica execution	Nothing (post-generation)
Protects against bad endpoint	Yes ( $<n/3$ )	No
Threshold	$f<n/3$ (asynchronous)	$c<k/2$

Table 1: MIRROR is not a consensus protocol. It provides integrity for a message in transit under honest endpoints, not agreement among mutually distrusting replicas.

Figure 2: ASR on MBPP (AutoGen,

k=5

) as a function of compromised fraction

\alpha=c/k

, for

c\in\{1,\dots,5\}

. The dashed line marks the theoretical threshold

\alpha=0.5

Dataset	Framework	No Def.	Judge	FPR (Judge)	MIRROR (k=5)
MMLU	AutoGen	$60.0\pm 24.9$	$0.4$	$0.0$	$\mathbf{0.0}$
	CAMEL	$30.2\pm 35.8$	$0.0$	$10.2$	$\mathbf{0.0}$
MBPP	AutoGen	$100.0$	$0.0$	$0.0$	$\mathbf{0.0}$
	CAMEL	$27.5\pm 15.5$	$0.0$	$44.2$	$\mathbf{0.0}$
HumanEval	AutoGen	$100.0$	$0.0$	$0.0$	$\mathbf{0.0}$
	CAMEL	$37.0\pm 13.9$	$0.0$	$40.9$	$\mathbf{0.0}$

Table 2: ASR (%) for AutoGen and CAMEL across four topologies (Chain, Tree, Complete, Random), reported as mean

\pm

standard deviation over the four topologies of Table 3 . Baselines vary widely by topology (MMLU/CAMEL spans

1.4

–

89.8

); MIRROR is 0.0% in every configuration. LLM-as-a-Judge also lowers ASR but with substantial false positives.

Figure 3: MetaGPT with Gemini 2.5 Pro. (a) ASR: MIRROR reaches 0% on both datasets; LLM-as-a-Judge partially mitigates. (b) Relative token consumption: MIRROR $1\times$ baseline, LLM-as-a-Judge $35\times$ .

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: AiTM Attack Success Rate (ASR) without communication-layer defenses ( $k=1$ ) across datasets and topologies using AutoGen . Results use Gemma-4-31B-it under a worst-case adversary ( $\alpha=1$ ). ASR approaches 100% on code-generation tasks.

Dataset	Framework	Chain	Tree	Complete	Random
MMLU	AutoGen	20.1	57.9	83.7	78.2
	CAMEL	89.8	1.4	26.6	3.1
MBPP	AutoGen	100.0	100.0	100.0	100.0
	CAMEL	54.1	16.4	21.5	17.8
HumanEval	AutoGen	100.0	100.0	100.0	100.0
	CAMEL	59.1	37.8	22.0	29.0

Appendix

Table 3: ASR (%) across individual communication topologies. Baselines vary substantially with structure; MIRROR is 0.0% in every configuration.

Multi-Agent System Security

Multi-agent system security studies attacks, trust, privacy, and defenses in interacting AI agents, including language-model teams, robot swarms, and learned controllers.

See all 181 papers

May 4, 2026

When Alignment Isn't Enough: Response-Path Attacks on LLM Agents

Bring-Your-Own-Key (BYOK) agent architectures let users route LLM traffic through third-party relays, creating a critical integrity gap: a malicious relay can modify an aligned LLM response after generation but before agent execution. We formalize this post-alignment tampering threat and show that, without end-to-end integrity, the relay can observe, suppress, or replace downstream messages, making even perfectly aligned LLMs ineffective against such attacks. We instantiate this threat as the Relay Tampering Attack (RTA), which performs multi-round strategic rewriting, minimal security-critical edits, and stealth restoration by resubmitting tampered outputs to the upstream LLM. Across AgentDojo and ASB with six LLMs, RTA achieves up to 99.1% attack success, outperforming prompt-injection baselines with modest overhead. Case studies on OpenClaw and Claude Code demonstrate real-world feasibility, and evaluations of four defenses show that none fully prevent RTA. Finally, we propose a time-based detection defense that mitigates RTA while preserving agent utility.

Mingyu Luo, Zihan Zhang, Zesen Liu +7

Fudan University, Shanghai, China · The Hong Kong University of Science and Technology, Hong Kong, China · Huazhong University of Science and Technology, Wuhan, China

AI Agent Reliability LLM Agent Security

Ask PDF

Oct 11, 2026

When Messages Go Wrong: Understanding Communication Faults in LLM-Based Multi-Agent Systems

LLM-based multi-agent systems (LLM-MAS) use specialized agents that exchange messages to accomplish complex tasks. Their reliance on networked protocols, remote tools, and model endpoints exposes communication to message loss, delay, and context expiration. Because agents often exchange open-ended natural language, anomalies can alter task-relevant information while leaving messages processable, allowing semantic errors to propagate through subsequent interactions. Systematic studies of faults in inter-agent communication remain limited. This paper presents a large-scale empirical study of how communication faults manifest, propagate, and affect task outcomes in LLM-MAS. We construct a cross-layer taxonomy linking lower-stack disturbances to application-visible faults and develop a fault-injection and tracing pipeline. Our evaluation covers more than 29,000 executions across 100 tasks, five domains, three workflow topologies, and three model configurations. We find that 20.7% of failures with complete detection records occur without an immediate failure signal, reaching 76.2% for partial-content faults. Flat maintains 53.0% task success under communication faults, compared with 3.3% and 3.2% for Sequential and Hierarchical, respectively. This advantage primarily arises when an alternative information path preserves the evidence required by downstream agents. We also evaluate execution-side and evidence protection mechanisms and find that they recover different failure cases. Evidence recovery depends on whether trustworthy information remains accessible through an unaffected path. These observations provide empirical insights into communication-fault propagation, workflow resilience, and protection design for LLM-MAS.

Jinhao Zhou, Xiaoyu Zhang, Jiongchi Yu +2

Waseda University, Japan · The Hong Kong University of Science and Technology, Hong Kong SAR, China · Nanyang Technological University, Singapore +2

Multi-Agent LLM Systems Multi-Agent Communication LLM Agent Reliability

Ask PDF

May 1, 2026

When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems

Large language model (LLM)-powered multi-agent systems (MAS) enable agents to communicate and share information, achieving strong performance on complex tasks. However, this communication also creates an attack surface where malicious agents can propagate misinformation and manipulate group decisions, undermining MAS safety. Existing embedding-based defenses aim to detect and prune suspicious agents, but their effectiveness depends on a clear separation between the text embeddings of malicious and benign messages. Attackers can circumvent such defenses by crafting messages whose embeddings lie close to benign ones. We analyze this failure mode theoretically and validate it empirically with three attacks, Slow Drift, Benign Wrapper, and Chaos Seeding. Our analysis further reveals a fundamental limitation of embedding-based defenses: because they rely solely on the text embeddings, they ignore token-level confidence signals such as logits, which can remain informative when embeddings are not distinguishable under attack. We propose using confidence scores to prune or down-weight messages during MAS communication. Experiments show improved robustness across models, datasets, and communication topologies. Moreover, we find that the effectiveness of confidence signals decays over communication rounds, highlighting the importance of early intervention. This insights can inform and inspire future work on MAS attacks and defenses.

Lingxi Zhang, Guangtao Zheng, Hanjie Chen

1Rice University · University of Virginia

Adversarial Attacks Language Model Robustness Multi-Agent System Security Multi-Agent LLMs

Ask PDF

Abstract

Multi-Agent System Security

Explore similar work

When Alignment Isn't Enough: Response-Path Attacks on LLM Agents

When Messages Go Wrong: Understanding Communication Faults in LLM-Based Multi-Agent Systems

When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems