Research map / Multi-agent systems and games / LLM agents
Cowpox: Towards the Immunity of VLM-based Multi-Agent Systems
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Cowpox, a defense that deploys a few cure-generating agents in a VLM-based multi-agent system so that adversarially optimized cure samples outrank infectious virus samples in RAG retrieval, recovering infected agents and building immunity.
Problem
Infectious jailbreak attacks (AgentSmith) can spread adversarial "virus" samples through the memory banks and RAG retrieval of VLM-based multi-agent systems, compromising the whole system; existing defenses protect individual models rather than the system's recovery dynamics.
Approach
Deploy a small number of defender-controlled "Cowpox" agents that detect suspicious chat outputs with an LLM/VLM inspector and replace the virus in their album with an adversarially optimized benign cure sample that has a higher RAG score than the virus; the cure then spreads like normal content, converting the positive infection feedback loop into a negative one. A differential-equation transmiss
Key results
- With 4 Cowpox agents (~3% of 128 agents), Strategy I recovers over 95% of infected agents in simulation under Border and Pixel attacks (e.g., current infection peak drops from ~99% to ~74% for Border h=6 Strategy I).
- Cowpox keeps the cumulative infectious rate around 90%, implying roughly 10% of agents are prevented from being infected once.
- The output analysis module achieves 84.7% ACC (1-turn) and 89.1% ACC (3-turn) on AdvBench plus benign chats.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Cowpox Strategy 1 or Strategy 2 | LLaVA-1.5-7B multi-agent system · Border attack, h=6 | current infectious rate at r50: 93.75 -> 3.13 | Helped |
| Add Cowpox Strategy 1 or Strategy 2 | LLaVA-1.5-7B multi-agent system · Border attack, h=8 | cumulative infectious rate at r32: 100.00 -> 91.41; 100.00 -> 92.19 | Helped |
| Add Cowpox Strategy 1 or Strategy 2 | LLaVA-1.5-7B multi-agent system · Pixel attack, epsilon=8/255 | current infectious rate at r50: 96.88 -> 3.13; 96.88 -> 0.78 | Helped |
| Use 3-turn rather than 1-turn output analysis | Cowpox output analysis module · malicious and benign output classification | ACC (%): 84.7 -> 89.1 | Helped |
| Use 3-turn rather than 1-turn output analysis | Cowpox output analysis module · malicious and benign output classification | FPR (%): 2.8 -> 7.9 | Hurt |
| Use 3-turn rather than 1-turn output analysis | Cowpox output analysis module · malicious and benign output classification | FNR (%): 12.5 -> 3.0 | Helped |
| Recover the virus sample using Cowpox Strategy 1 | virus samples from Border attack h=6 · Epoch=10 | BLEU similarity to benign-sample answers: 0.01 -> 0.8492 | Helped |
| Increase album size from 5 to 15 (ablation) | Cowpox multi-agent system · transmission dynamics | maximum current infectious rate | Helped |
| Increase album size from 5 to 15 (ablation) | Cowpox multi-agent system · transmission dynamics | cumulative infectious rate | Hurt |
| Increase agent history length (ablation) | Cowpox multi-agent system · transmission dynamics | peak current infectious rate | Helped |
| Increase the number of initially infected agents from 1 to 16 (ablation) | Cowpox multi-agent system · transmission dynamics | peak current infectious rate | No clear effect |
| Increase the number of Cowpox agents from 1 to 16 (ablation) | Cowpox multi-agent system · transmission dynamics | maximum current infectious rate | Helped |
Surprising findings
- The output analysis module is weak (FPR up to 7.9%), yet the system-level defense still works because cure samples are retried across many rounds.
- Adaptive attacks that optimize against the cure yield a much lower second infection peak, since the cure's RAG score is hard to exceed while keeping the virus malicious.
Limitations
- Evaluation limited to a single simulated multi-agent environment with homogeneous LLaVA-1.5-7B agents.
- Cure samples lose some information from the original sample and the RAG tends to select only one or two cures, reducing topic diversity.
- Output analysis module is not strong (FPR/FNR of several percent), relying on the defender's multi-round checks.
Experimental setup
Datasets: AdvBench LLaVA-Bench
Benchmarks: AdvBench LLaVA-Bench
Metrics: current infectious rate cumulative infectious rate infectious chance accuracy FPR FNR BLEU CLIP score
Baselines: W/O. Cowpox (no defense) AgentSmith
Builds on: AgentSmith retrieval-augmented generation LLaVA-1.5 CLIP
Closest papers by meaning
- ReaLM: A Unified Red-Teaming Benchmark for Physical-World VLMs (NeurIPS 2026 · similarity 0.85)
- Dissecting Adversarial Robustness of Multimodal LM Agents (ICLR 2025 · similarity 0.84)
- When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems (ICML 2026 · similarity 0.84)
- MaMa: A Game-Theoretic Approach for Designing Safe Agentic Systems (ICML 2026 · similarity 0.84)
- Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation (ICML 2026 · similarity 0.83)
- TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Exploration (CVPR 2026 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.