Research map / Multi-agent systems and games / LLM agents

Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Backward Propagation Detection (BPD), which models multi-agent system communication as a signed temporal DAG and backpropagates LLM-scored edge contributions to flag and prune malicious agents without training.

Problem

Corruption attacks in LLM multi-agent systems propagate contagiously through communication, and existing defenses are either output-based, rely on local signals, or assume static graphs requiring retraining.

Approach

Reformulate MAS communication as a signed DAG where each edge carries an LLM-assigned score in {-1,0,1}; compute each agent's contribution to the final answer via a single backward pass (a signed, layer-wise PageRank variant), flag agents whose contribution deviates from the majority, and remove their outgoing messages.

Key results

• BPD reaches 85.4% (Flat) and 87.5% (Hierarchy) average answer accuracy on MMLU with GPT-4o, versus 83.7% and 85.5% for the best baseline G-Safeguard.
• BPD achieves over 90% average monitor accuracy on MMLU (90.7% Flat, 93.3% Hierarchy) with GPT-4o.
• BPD adds about 9.0% and 10.6% time overhead over a standard MAS for Flat and Hierarchy structures.

Surprising findings

• Removing backpropagation (using raw local scores only) costs only 2-3 points of answer accuracy but 6-8 points of monitor accuracy.
• Under system-aware adaptive attacks the monitor accuracy drops to 81-82%, yet final answer accuracy degrades only slightly because the method also isolates easily misled agents.

Limitations

• Attacks exceeding the Byzantine threshold or not targeting the scoring mechanism are out of scope.
• Relies on an external LLM scorer whose reliability was checked on only 50 sentences.
• Evaluated only on two MAS structures with a fixed set of three rounds and five agents and on two backbone models.

Experimental setup

Datasets: MMLU Alpaca Samsum ChatDoctor

Benchmarks: MMLU Alpaca Samsum ChatDoctor

Metrics: answer accuracy monitor accuracy (malicious agent detection) BLEURT GPT-4 score (1-5) time overhead

Baselines: G-Safeguard AgentXposed Challenger Inspector

Builds on: PageRank G-Safeguard AgentXposed

Closest papers by meaning

• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems (ICML 2026 · similarity 0.90)
• When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems (ICML 2026 · similarity 0.89)
• Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS (AAAI 2026 · similarity 0.88)
• Cut the Crap: An Economical Communication Pipeline for LLM-based Multi-Agent Systems (ICLR 2025 · similarity 0.87)
• GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling (NeurIPS 2025 · similarity 0.87)
• Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning (CVPR 2026 · similarity 0.87)