MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems

Mohammad Kachuee; Phu Mon Htut; Sheng Li; Nikolaos Pappas; Miguel Ballesteros Martinez; Yassine Benajiba; Sujith Ravi; Dan Roth

cs.CROct 20, 2026

MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems

Authors: Mohammad Kachuee, Phu Mon Htut, Sheng Li, Nikolaos Pappas, Miguel Ballesteros Martinez, Yassine Benajiba, Sujith Ravi, Dan Roth

Organizations: Oracle AI

Abstract

Agentic AI extends large language models (LLMs) from generating responses to planning and executing complex workflows, substantially expanding their utility while exposing applications to unsafe actions, information leakage, and adversarial manipulation. Multi-agent systems further expand these capabilities through specialization and collaboration, but distributed authority, heterogeneous roles, and opaque or potentially compromised participants make safeguarding even more challenging. Existing defenses address important individual threats but provide fragmented coverage across local execution, system-level interactions, and enforcement mechanisms. We introduce MAS-Guard, a unified framework that closes this gap for safeguarding single- and multi-agent AI applications containing both instrumentable and opaque agents. Within instrumentable agents, the proposed local Agent Guardrail (A-Guard) layer applies task-specific experts to assess agentic events. At the system level, developer-owned Agent Charters and a Control Plane combine deterministic structural checks of routes, agent capabilities, and message formats with semantic assessments of roles and message content. These complementary layers enable enforcement through a shared set of interventions: allow, reflection, confirmation, and block. Evaluated across six benchmarks covering diverse single- and multi-agent scenarios with three agent LLMs from different providers, MAS-Guard reduces the overall attack success rate by 71.5-86.3% relative to unguarded agents, while meeting the utility reference criterion on benign tasks.

Figures & tables

Figure 1: MAS-Guard combines system-level safeguards defined by Agent Charters and Control Plane configuration with agent-local A-Guard checks to protect interactions among users, agents, and tools.

Figure 2: A-Guard provides a local guardrail layer to audit agentic events for instrumentable agents.

Policy Component	Specification Summary
Agent registry	Runtime agent identities, Charter bindings, and optional local A-Guard attachments.
Route policy	Directed always_allow and always_block entries, with an unlisted-route fallback.
I/O format policy	accepted_types in the input and output contracts.
I/O type policy	prohibited_content_types , such as credentials or PII.
I/O topic policy	unconstrained , allowlist , denylist , or allow_and_deny , with accepted/prohibited topic descriptions.
Capability scope	Disjoint in_scope and out_of_scope feature lists.

Table 1: Policy components of the system guardrail layer. Agent Charters define roles, input/output boundaries, and capability scope; the Control Plane binds these contracts to the application and connects structural and semantic checks to consistent enforcement.

Benchmark	Samples (Adv./Ben.)	Coverage	ASR	Utility
ACIArena An et al. ( 2026 )	1,000 / 99	Multi-agent. Code and mathematics tasks across 34 configurations of AgentVerse, AutoGen, LLM Debate, MetaGPT, and self-consistency systems. Covers benign operation, instruction hijacking, task disruption, and information disclosure.	Mean attack-success score assigned by the original benchmark’s attack verifier on adversarial cases.	Mean task score assigned by the original benchmark’s task verifier on benign cases.
TAMAS Kavathekar et al. ( 2026 )	355 / 355	Multi-agent. Education, finance, healthcare, legal, and news tasks across AutoGen and CrewAI. Covers Byzantine behavior, collusion, direct and indirect prompt injection, impersonation, and benign controls.	Rate at which the attacker achieves its objective, as determined by target-tool execution or the benchmark’s judge.	Mean fraction of required benign tools successfully invoked.
AgentLeak El Yagoubi et al. ( 2026 )	666 / 334	Multi-agent. Healthcare, finance, legal, and corporate workflows under benign and two adversarial threat levels. Evaluated with LangChain and CrewAI across output, inter-agent, and tool-call channels.	Rate of adversarial cases with sensitive information leaked in any of the four monitored channels.	Rate of successful benign-task completion.
OmniLeak Naik et al. ( 2026 )	1,000 / 500	Multi-agent. Our re-implementation of synthetic orchestrator–SQL–notification workflows covering four prompt-injection categories, notification hijacking, and five benign or authorized control cohorts.	Mean exposure severity, from 0 for no exposure to 1 for complete exfiltration.	Rate of successful benign or explicitly authorized task completion.
OverThink Kumar et al. ( 2025 )	2,324 / 332	Single-agent. FreshQA retrieval-augmented question answering, each paired with one clean context and seven adversarial reasoning-decoy variants.	Rate of attacks resulting the usage of at least $2{\times}$ and 256 more reasoning tokens than the paired clean case.	Accuracy on clean, unattacked questions.
ASB Zhang et al. ( 2025 )	1,270 / 230	Single-agent. Ten application scenarios covering direct and observation injection, memory poisoning, mixed attacks, Plan-of-Thought backdoors, and clean controls.	Rate at which the designated malicious tool executes successfully.	Mean fraction of required benign tools executed successfully.

Table 2: Coverage, sample counts, and metric definitions for the benchmarks used in our experiments. Sample counts report adversarial (Adv.) and benign (Ben.) test episodes for each benchmark.

Panel of Figure 3 — Figure 3: Overall ASR–Utility comparison for (a) GPT-5.6-Terra, (b) Muse-Glimmer-30B, and (c) Grok-4.3 agents. Whiskers denote $95\%$ confidence intervals. The green reference marks the lower confidence bound of No-Guardrail utility; points in the green shaded region satisfy the utility criterion.

	Benchmark ASR (%)
Method	ACIArena [-2pt]( An et al. )	AgentLeak [-2pt]( El Yagoubi et al. )	ASB [-2pt]( Zhang et al. )	OmniLeak [-2pt]( Naik et al. )	OverThink [-2pt]( Kumar et al. )	TAMAS [-2pt]( Kavathekar et al. )	Overall
No-Guardrail -2pt	24.0 [-2pt] $\pm\,2.7$	23.1 [-2pt] $\pm\,3.4$	44.6 [-2pt] $\pm\,2.8$	0.1 [-2pt] $\pm\,0.1$	34.5 [-2pt] $\pm\,2.0$	7.6 [-2pt] $\pm\,3.2$	27.1 [-2pt] $\pm\,1.1$
MAS-Guard [-2pt](This Work)	11.0 [-2pt] $\pm\,2.1$	5.0 [-2pt] $\pm\,1.9$	13.2 [-2pt] $\pm\,2.0$	0.0 [-2pt] $\pm\,0.4$	0.0 [-2pt] $\pm\,0.2$	2.5 [-2pt] $\pm\,2.2$	4.8 [-2pt] $\pm\,0.5$
LlamaFirewall [-2pt]( Chennabasappa et al. )	22.7 [-2pt] $\pm\,2.7$	21.6 [-2pt] $\pm\,3.3$	19.6 [-2pt] $\pm\,2.3$	0.1 [-2pt] $\pm\,0.1$	35.4 [-2pt] $\pm\,2.0$	5.1 [-2pt] $\pm\,2.8$	22.1 [-2pt] $\pm\,1.0$
ToolSafe [-2pt] ( Mou et al., 2026 )	22.2 [-2pt] $\pm\,2.7$	13.4 [-2pt] $\pm\,2.8$	4.3 † [-2pt] $\pm\,1.3$	0.0 † [-2pt] $\pm\,0.4$	14.0 † [-2pt] $\pm\,1.5$	2.5 [-2pt] $\pm\,2.2$	10.6 † [-2pt] $\pm\,0.8$
Delimiter [-2pt] ( Hines et al., 2024 )	22.1 [-2pt] $\pm\,2.7$	23.3 [-2pt] $\pm\,3.4$	15.2 † [-2pt] $\pm\,2.1$	0.1 † [-2pt] $\pm\,0.1$	0.7 [-2pt] $\pm\,0.4$	2.0 † [-2pt] $\pm\,2.0$	9.0 † [-2pt] $\pm\,0.7$

Table 3: Benchmark-level ASR with 95% margins of error for the GPT-5.6-Terra Agent. Lower is better.

Components			ASR (%)
A-Guard	Deterministic	Semantic	ACIArena [-2pt]( An et al. )	AgentLeak [-2pt]( El Yagoubi et al. )	ASB [-2pt]( Zhang et al. )	OmniLeak [-2pt]( Naik et al. )	OverThink [-2pt]( Kumar et al. )	TAMAS [-2pt]( Kavathekar et al. )	Overall
✗ $\dagger$	✗	✗	24.0 [-2pt] $\pm\,2.7$	23.1 [-2pt] $\pm\,3.4$	44.6 [-2pt] $\pm\,2.8$	0.1 [-2pt] $\pm\,0.1$	34.5 [-2pt] $\pm\,2.0$	7.6 [-2pt] $\pm\,3.2$	27.1 [-2pt] $\pm\,1.1$
✓ $\ddagger$	✓	✓	11.0 [-2pt] $\pm\,2.1$	5.0 [-2pt] $\pm\,1.9$	13.2 [-2pt] $\pm\,2.0$	0.0 [-2pt] $\pm\,0.4$	0.0 [-2pt] $\pm\,0.2$	2.5 [-2pt] $\pm\,2.2$	4.8 [-2pt] $\pm\,0.5$
✓	✗	✗	23.8 [-2pt] $\pm\,2.7$	10.2 [-2pt] $\pm\,2.5$	15.0 [-2pt] $\pm\,2.1$	0.0 [-2pt] $\pm\,0.4$	0.0 [-2pt] $\pm\,0.2$	5.9 [-2pt] $\pm\,3.0$	7.8 [-2pt] $\pm\,0.7$
✗	✓	✓	11.1 [-2pt] $\pm\,2.1$	5.0 [-2pt] $\pm\,1.9$	38.9 [-2pt] $\pm\,2.7$	0.2 [-2pt] $\pm\,0.1$	34.8 [-2pt] $\pm\,2.0$	2.5 [-2pt] $\pm\,2.2$	22.0 [-2pt] $\pm\,1.0$
✗	✓	✗	22.3 [-2pt] $\pm\,2.7$	22.8 [-2pt] $\pm\,3.3$	44.7 [-2pt] $\pm\,2.8$	0.2 [-2pt] $\pm\,0.1$	33.4 [-2pt] $\pm\,1.9$	7.3 [-2pt] $\pm\,3.2$	26.4 [-2pt] $\pm\,1.1$

Table 4: Ablation results using the GPT-5.6-Terra agent. ASR (%) with 95% margins of error. Lower is better.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Field	Type	Meaning
charter_id	string	Unique identifier for the reusable Charter.
objective	title , description	Human-readable role and task objective used by semantic compliance checks.
input_contract	I/O contract	Accepted input formats, prohibited content-risk classes, and an input topic policy.
output_contract	I/O contract	Accepted output formats, prohibited content-risk classes, and an output topic policy.
features	in_scope , out_of_scope lists	Permitted and prohibited boundary-observable capabilities; the two lists must not overlap.
Closed vocabularies

Appendix

Table 5: Agent Charter fields and vocabularies used in this work. An I/O contract contains accepted_types , prohibited_content_types , and a topic_policy with a mode and accepted/prohibited topic lists.

Field	Type or values	Meaning
id	string	Unique identifier for the Control Plane policy.
mode	shadow or enforce	Shadow mode records the decision that would be taken; enforcement mode applies it to the event.
event_processing_ timeout_seconds	positive number or null	Optional deadline for evaluating one event.
enforcement. missing_charter_action	isolate or pass	Handling of an event whose required runtime identity cannot be resolved to a registered Charter.
agent_registry.agents	list of registry entries	Each entry gives an agent_id , its charter_id , and an optional aguard_orchestrator_config for local A-Guard attachment.
route_policy	route tables and fallback	always_allow and always_block entries contain from , to , and an optional reason; unlisted_route_action is block , reflect , or pass .

Appendix

Table 6: Control Plane configuration fields used in this work. The implementation value pass corresponds to the Allow decision used in the paper.

	Benchmark ASR (%)
Method	ACIArena [-2pt]( An et al. )	AgentLeak [-2pt]( El Yagoubi et al. )	ASB [-2pt]( Zhang et al. )	OmniLeak [-2pt]( Naik et al. )	OverThink [-2pt]( Kumar et al. )	TAMAS [-2pt]( Kavathekar et al. )	Overall
No-Guardrail -2pt	40.0 [-2pt] $\pm\,3.1$	24.9 [-2pt] $\pm\,3.4$	43.4 [-2pt] $\pm\,2.7$	0.1 [-2pt] $\pm\,0.1$	36.6 [-2pt] $\pm\,2.0$	15.2 [-2pt] $\pm\,4.1$	30.6 [-2pt] $\pm\,1.1$
MAS-Guard [-2pt](This Work)	7.9 [-2pt] $\pm\,1.8$	3.8 [-2pt] $\pm\,1.7$	11.9 [-2pt] $\pm\,1.9$	0.1 [-2pt] $\pm\,0.6$	0.0 [-2pt] $\pm\,0.2$	5.6 [-2pt] $\pm\,2.9$	4.2 [-2pt] $\pm\,0.5$
LlamaFirewall [-2pt]( Chennabasappa et al. )	39.5 [-2pt] $\pm\,3.1$	21.2 [-2pt] $\pm\,3.3$	12.0 † [-2pt] $\pm\,1.9$	0.1 [-2pt] $\pm\,0.1$	37.0 [-2pt] $\pm\,2.0$	10.7 [-2pt] $\pm\,3.6$	24.0 [-2pt] $\pm\,1.0$
ToolSafe [-2pt] ( Mou et al., 2026 )	37.9 [-2pt] $\pm\,3.0$	14.0 [-2pt] $\pm\,2.8$	0.1 † [-2pt] $\pm\,0.4$	1.9 † [-2pt] $\pm\,0.4$	15.6 † [-2pt] $\pm\,1.5$	7.9 [-2pt] $\pm\,3.3$	13.3 † [-2pt] $\pm\,0.8$
Delimiter [-2pt] ( Hines et al., 2024 )	32.9 [-2pt] $\pm\,3.0$	24.5 [-2pt] $\pm\,3.4$	9.1 [-2pt] $\pm\,1.7$	0.0 † [-2pt] $\pm\,0.1$	3.0 [-2pt] $\pm\,0.8$	3.9 † [-2pt] $\pm\,2.6$	10.4 † [-2pt] $\pm\,0.7$

Appendix

Table 7: Benchmark-level ASR with 95% margins of error for the Muse-Glimmer-30B Agent. Lower is better.

	Benchmark ASR (%)
Method	ACIArena [-2pt]( An et al. )	AgentLeak [-2pt]( El Yagoubi et al. )	ASB [-2pt]( Zhang et al. )	OmniLeak [-2pt]( Naik et al. )	OverThink [-2pt]( Kumar et al. )	TAMAS [-2pt]( Kavathekar et al. )	Overall
No-Guardrail -2pt	58.1 [-2pt] $\pm\,3.1$	42.8 [-2pt] $\pm\,3.8$	70.8 [-2pt] $\pm\,2.6$	16.3 [-2pt] $\pm\,2.1$	0.0 [-2pt] $\pm\,0.2$	33.2 [-2pt] $\pm\,5.1$	30.9 [-2pt] $\pm\,1.1$
MAS-Guard [-2pt](This Work)	26.6 [-2pt] $\pm\,2.8$	17.0 [-2pt] $\pm\,3.0$	13.8 [-2pt] $\pm\,2.0$	0.1 [-2pt] $\pm\,0.1$	0.0 [-2pt] $\pm\,0.2$	8.5 [-2pt] $\pm\,3.4$	8.8 [-2pt] $\pm\,0.7$
LlamaFirewall [-2pt]( Chennabasappa et al. )	58.1 [-2pt] $\pm\,3.1$	39.8 [-2pt] $\pm\,3.8$	12.9 † [-2pt] $\pm\,2.0$	4.3 [-2pt] $\pm\,0.9$	0.0 [-2pt] $\pm\,0.2$	21.7 [-2pt] $\pm\,4.6$	17.1 [-2pt] $\pm\,0.9$
ToolSafe [-2pt] ( Mou et al., 2026 )	56.2 [-2pt] $\pm\,3.1$	29.4 [-2pt] $\pm\,3.6$	1.0 † [-2pt] $\pm\,0.7$	0.1 † [-2pt] $\pm\,0.1$	0.0 † [-2pt] $\pm\,0.2$	14.6 [-2pt] $\pm\,4.1$	12.5 † [-2pt] $\pm\,0.8$
Delimiter [-2pt] ( Hines et al., 2024 )	59.4 [-2pt] $\pm\,3.1$	42.6 [-2pt] $\pm\,3.8$	57.4 † [-2pt] $\pm\,2.7$	6.0 [-2pt] $\pm\,1.4$	0.0 [-2pt] $\pm\,0.2$	17.8 † [-2pt] $\pm\,4.3$	26.2 † [-2pt] $\pm\,1.1$

Appendix

Table 8: Benchmark-level ASR with 95% margins of error for the Grok-4.3 Agent. Lower is better.

	Benchmark Utility (%)
Method	ACIArena	AgentLeak	ASB	OmniLeak	OverThink	TAMAS	Overall
No-Guardrail	80.8 [-2pt] $\pm\,8.8$	22.2 [-2pt] $\pm\,4.8$	47.6 [-2pt] $\pm\,5.0$	65.2 [-2pt] $\pm\,4.3$	81.3 [-2pt] $\pm\,4.5$	18.7 [-2pt] $\pm\,2.9$	50.0 [-2pt] $\pm\,2.1$
MAS-Guard	81.8 [-2pt] $\pm\,8.7$	22.2 [-2pt] $\pm\,4.8$	43.5 [-2pt] $\pm\,4.8$	61.6 [-2pt] $\pm\,4.3$	80.7 [-2pt] $\pm\,4.6$	18.3 [-2pt] $\pm\,2.8$	48.4 [-2pt] $\pm\,2.1$
LlamaFirewall	79.8 [-2pt] $\pm\,8.9$	20.7 [-2pt] $\pm\,4.7$	43.7 [-2pt] $\pm\,4.8$	62.0 [-2pt] $\pm\,4.3$	82.2 [-2pt] $\pm\,4.5$	18.7 [-2pt] $\pm\,2.9$	48.5 [-2pt] $\pm\,2.1$
ToolSafe	81.8 [-2pt] $\pm\,8.7$	20.4 [-2pt] $\pm\,4.6$	40.0 [-2pt] $\pm\,4.7$	40.4 [-2pt] $\pm\,4.4$	71.1 [-2pt] $\pm\,5.1$	19.5 [-2pt] $\pm\,3.0$	40.5 [-2pt] $\pm\,2.1$
Delimiter	82.8 [-2pt] $\pm\,8.6$	18.9 [-2pt] $\pm\,4.5$	39.4 [-2pt] $\pm\,4.5$	56.4 [-2pt] $\pm\,4.4$	82.5 [-2pt] $\pm\,4.5$	11.8 [-2pt] $\pm\,2.3$	45.1 [-2pt] $\pm\,2.1$

Appendix

Table 9: Benchmark-level Utility with 95% margins of error for GPT-5.6-Terra agent. Higher is better.

	Benchmark Utility (%)
Method	ACIArena	AgentLeak	ASB	OmniLeak	OverThink	TAMAS	Overall
No-Guardrail	57.6 [-2pt] $\pm\,9.8$	18.0 [-2pt] $\pm\,4.5$	42.0 [-2pt] $\pm\,3.3$	77.6 [-2pt] $\pm\,3.9$	74.7 [-2pt] $\pm\,4.9$	25.0 [-2pt] $\pm\,3.5$	50.7 [-2pt] $\pm\,2.1$
MAS-Guard	58.6 [-2pt] $\pm\,9.8$	17.1 [-2pt] $\pm\,4.4$	42.0 [-2pt] $\pm\,3.2$	78.2 [-2pt] $\pm\,3.8$	73.5 [-2pt] $\pm\,5.0$	23.3 [-2pt] $\pm\,3.3$	50.2 [-2pt] $\pm\,2.1$
LlamaFirewall	57.6 [-2pt] $\pm\,9.8$	18.3 [-2pt] $\pm\,4.5$	38.3 [-2pt] $\pm\,3.1$	77.0 [-2pt] $\pm\,3.9$	73.8 [-2pt] $\pm\,5.0$	23.4 [-2pt] $\pm\,3.4$	49.7 [-2pt] $\pm\,2.1$
ToolSafe	59.6 [-2pt] $\pm\,9.8$	18.3 [-2pt] $\pm\,4.5$	35.6 [-2pt] $\pm\,3.4$	50.6 [-2pt] $\pm\,4.4$	65.1 [-2pt] $\pm\,5.3$	24.6 [-2pt] $\pm\,3.4$	41.0 [-2pt] $\pm\,2.1$
Delimiter	58.6 [-2pt] $\pm\,9.8$	17.4 [-2pt] $\pm\,4.4$	48.7 [-2pt] $\pm\,2.8$	39.0 [-2pt] $\pm\,4.3$	72.3 [-2pt] $\pm\,5.1$	15.0 [-2pt] $\pm\,2.7$	38.7 [-2pt] $\pm\,2.0$

Appendix

Table 10: Benchmark-level Utility with 95% margins of error for Muse-Glimmer-30B agent. Higher is better.

	Benchmark Utility (%)
Method	ACIArena	AgentLeak	ASB	OmniLeak	OverThink	TAMAS	Overall
No-Guardrail	70.7 [-2pt] $\pm\,9.6$	25.1 [-2pt] $\pm\,4.9$	65.9 [-2pt] $\pm\,3.5$	87.4 [-2pt] $\pm\,3.2$	73.2 [-2pt] $\pm\,5.0$	30.1 [-2pt] $\pm\,3.4$	59.0 [-2pt] $\pm\,2.1$
MAS-Guard	71.7 [-2pt] $\pm\,9.6$	22.8 [-2pt] $\pm\,4.8$	65.2 [-2pt] $\pm\,3.5$	88.8 [-2pt] $\pm\,3.1$	73.5 [-2pt] $\pm\,5.0$	26.8 [-2pt] $\pm\,3.2$	58.4 [-2pt] $\pm\,2.1$
LlamaFirewall	65.7 [-2pt] $\pm\,9.8$	25.4 [-2pt] $\pm\,4.9$	58.0 [-2pt] $\pm\,3.8$	85.8 [-2pt] $\pm\,3.3$	69.6 [-2pt] $\pm\,5.1$	32.8 [-2pt] $\pm\,3.5$	57.3 [-2pt] $\pm\,2.1$
ToolSafe	66.7 [-2pt] $\pm\,9.8$	23.9 [-2pt] $\pm\,4.9$	49.1 [-2pt] $\pm\,3.6$	49.4 [-2pt] $\pm\,4.4$	61.5 [-2pt] $\pm\,5.3$	32.5 [-2pt] $\pm\,3.5$	44.6 [-2pt] $\pm\,2.1$
Delimiter	68.7 [-2pt] $\pm\,9.7$	23.7 [-2pt] $\pm\,4.9$	58.5 [-2pt] $\pm\,3.0$	86.2 [-2pt] $\pm\,3.3$	74.1 [-2pt] $\pm\,5.0$	20.7 [-2pt] $\pm\,2.9$	55.8 [-2pt] $\pm\,2.1$

Appendix

Table 11: Benchmark-level Utility with 95% margins of error for the Grok-4.3 agent. Higher is better.

Method	C1: disclosure	C2: unsafe tool	C3: notification	C4: retrieval
	ASR / Decision	ASR / Decision	Utility / Decision	Utility / Decision
No-Guardrail	1 / P	1 / P	1 / P	1 / P
MAS-Guard	0 / B	0 / B	1 / P	1 / P
Sandwich	0 / R	0 / R	1 / R	1 / R
Delimiter	1 / R	0 / R	1 / R	1 / R
ACI-Sentinel	1 / R	1 / P	1 / R	1 / R

Appendix

Table 12: Matched outcomes and decisive trace actions for the four qualitative cases. C1 and C2 are adversarial episodes (lower ASR is better); C3 and C4 are benign episodes (higher Utility is better). P = pass, B = block, and R = reflect.

Agent	Tokens (M)		GPU-h	Cost ($k)
	Input	Output
GPT-5.6-Terra	1,212	125	277	4.1
Muse-Glimmer-30B	1,253	150	1,050	4.6
Grok-4.3	1,220	110	950	5.3
Total	3,685	384	2,277	14.0

Appendix

Table 13: Estimated main-comparison resources, summed over all settings per agent. Tokens and costs include agent, guardrail, and judge inference. M denotes millions; $k denotes thousands of USD. CPU, storage, and network charges are excluded.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 504 papers

May 8, 2026

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation

LLM-based multi-agent systems (LLM-MAS) have become a promising paradigm for solving complex tasks through role specialization, tool use, memory, and collaborative reasoning. However, these interactions create new security risks that malicious instructions injected through messages, tools, or memories can propagate across agents and rounds, causing system-level compromise. Existing defenses largely rely on local filtering or graph-based anomaly detection, but they often fail to trace fine-grained propagation paths or remediate contaminated states without disrupting benign collaboration. We propose PropGuard, a propagation-aware framework for safeguarding LLM-MAS. PropGuard constructs a dual-view spatio-temporal graph that combines response-centric risk estimation with full-state evidence preservation. Guided by these risk priors, a GE-GRPO trained inspector sequentially explores the full-state graph to recover compact suspicious propagation subgraphs. PropGuard then verifies harmful propagation through subgraph-aware diagnosis and applies source-guided remediation to correct upstream contamination and replay affected downstream interactions. Experiments across four communication architectures and five attack settings demonstrate that PropGuard consistently lowers attack success while maintaining high task-level defense success, achieving a favorable effectiveness--efficiency trade-off.

Bingyu Yan, Xiaoming Zhang, Jinyu Hou +4

Beihang University · Beijing University of Posts and Telecommunications · City University of Hong Kong

LLM Agent Security Prompt Injection Attacks on AI Agents Multi-Agent System Security

Ask PDF

Jun 10, 2026

SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems

LLM-based multi-agent systems (MAS) solve complex tasks through inter-agent collaboration, but their communication-driven nature also allows security risks to spread across agents and trigger system-wide failures. Existing MAS defenses mainly follow a reactive paradigm after execution by detecting and isolating harmful agents, which may cause irreversible damage and degrade collaborative utility. To address this, we propose a proactive defense framework for MAS security, namely a Simulation-aware Interception Guard (SAIGuard). SAIGuard performs communication-state simulation over the MAS interaction graph, estimates the impact of incoming messages on local agent states and the global MAS state, and detects risky messages via reconstruction deviations from benign communication patterns. Instead of isolating agents, SAIGuard sanitizes or regenerates suspicious messages before it propagation into system. Experiments across diverse topologies and attack scenarios show that SAIGuard reduces attack success rates while maintaining MAS utility, outperforming reactive defenses.

Ruxue Shi, Yili Wang, Mengnan Du +4

School of Artificial Intelligence, Jilin University, Changchun, China · The Chinese University of Hong Kong, Shenzhen, China · School of Information and Communication Technology, Griffith University, Australia

LLM Agent Security Multi-Agent System Security Multi-Agent Communication Anomaly Detection

Ask PDF

Sep 1, 2026

SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems

Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely multi-agent security effect. We thus systematize MAS security through an execution-centered analysis of 197 works, covering six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS. We organize defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identify path closure and recovery as key challenges. We audit 44 evaluation and benchmark works and identify open challenges in isolating interaction effects, designing comparable and diagnostic metrics, supporting reuse across MAS designs, and evaluating open-system operation. Together, these findings motivate an interaction-aware view of MAS security: trace attacks end to end, test whether defenses close those paths, and evaluate system-level effects with appropriate counterfactuals.

Rui Yang, Junjie Xu, Zhengyu Liu +4

Johns Hopkins University · Nanyang Technological University

AI Agent Security Benchmarks Multi-Agent System Security Multi-Agent LLMs

Ask PDF

Abstract

AI Agent Security

Explore similar work

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation

SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems

SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems